# Flog Txt Version 1 # Analyzer Version: 4.3.0 # Analyzer Build Date: Sep 20 2021 05:59:55 # Log Creation Date: 28.09.2021 05:39:48.991 Process: id = "1" image_name = "de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797.exe" filename = "c:\\users\\rdhj0cnfevzx\\desktop\\de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797.exe" page_root = "0x3dc9d000" os_pid = "0x864" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x640" cmd_line = "\"C:\\Users\\RDhJ0CNFevzX\\Desktop\\de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797.exe\" " cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f142" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 118 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 119 start_va = 0x30000 end_va = 0x31fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 120 start_va = 0x40000 end_va = 0x54fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 121 start_va = 0x60000 end_va = 0x9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000060000" filename = "" Region: id = 122 start_va = 0xa0000 end_va = 0x19ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000a0000" filename = "" Region: id = 123 start_va = 0x1a0000 end_va = 0x1a3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 124 start_va = 0x1b0000 end_va = 0x1b1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 125 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 126 start_va = 0x400000 end_va = 0x49afff monitored = 1 entry_point = 0x4034f0 region_type = mapped_file name = "de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797.exe" filename = "\\Users\\RDhJ0CNFevzX\\Desktop\\de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797.exe") Region: id = 127 start_va = 0x778f0000 end_va = 0x77a6afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 128 start_va = 0x7ffb0000 end_va = 0x7ffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007ffb0000" filename = "" Region: id = 129 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 130 start_va = 0x7fff0000 end_va = 0x7ffb28afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 131 start_va = 0x7ffb28b00000 end_va = 0x7ffb28cc0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 132 start_va = 0x7ffb28cc1000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffb28cc1000" filename = "" Region: id = 270 start_va = 0x520000 end_va = 0x52ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000520000" filename = "" Region: id = 271 start_va = 0x657b0000 end_va = 0x65829fff monitored = 0 entry_point = 0x657c3290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 272 start_va = 0x65840000 end_va = 0x6588ffff monitored = 0 entry_point = 0x65858180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 273 start_va = 0x74650000 end_va = 0x7472ffff monitored = 0 entry_point = 0x74663980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 274 start_va = 0x65830000 end_va = 0x65837fff monitored = 0 entry_point = 0x658317c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 275 start_va = 0x530000 end_va = 0x7effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000530000" filename = "" Region: id = 276 start_va = 0x74650000 end_va = 0x7472ffff monitored = 0 entry_point = 0x74663980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 277 start_va = 0x75e80000 end_va = 0x75ffdfff monitored = 0 entry_point = 0x75f31b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 278 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 279 start_va = 0x7feb0000 end_va = 0x7ffaffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007feb0000" filename = "" Region: id = 280 start_va = 0x530000 end_va = 0x5edfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 281 start_va = 0x6f0000 end_va = 0x7effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 282 start_va = 0x74570000 end_va = 0x74601fff monitored = 0 entry_point = 0x745b0380 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 283 start_va = 0x7fb00000 end_va = 0x7fea0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sysmain.sdb" filename = "\\Windows\\AppPatch\\sysmain.sdb" (normalized: "c:\\windows\\apppatch\\sysmain.sdb") Region: id = 284 start_va = 0x20000 end_va = 0x23fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 285 start_va = 0x1c0000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 286 start_va = 0x5f0000 end_va = 0x6effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005f0000" filename = "" Region: id = 287 start_va = 0x66000000 end_va = 0x66152fff monitored = 1 entry_point = 0x66001af8 region_type = mapped_file name = "msvbvm60.dll" filename = "\\Windows\\SysWOW64\\msvbvm60.dll" (normalized: "c:\\windows\\syswow64\\msvbvm60.dll") Region: id = 288 start_va = 0x74790000 end_va = 0x748d6fff monitored = 0 entry_point = 0x747a1cf0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 289 start_va = 0x758f0000 end_va = 0x75a3efff monitored = 0 entry_point = 0x759a6820 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 290 start_va = 0x77820000 end_va = 0x7789afff monitored = 0 entry_point = 0x7783e970 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 291 start_va = 0x75680000 end_va = 0x7573dfff monitored = 0 entry_point = 0x756b5630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 292 start_va = 0x75740000 end_va = 0x75783fff monitored = 0 entry_point = 0x75759d80 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 293 start_va = 0x74b50000 end_va = 0x74bfcfff monitored = 0 entry_point = 0x74b64f00 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 294 start_va = 0x74620000 end_va = 0x7463dfff monitored = 0 entry_point = 0x7462b640 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 295 start_va = 0x74610000 end_va = 0x74619fff monitored = 0 entry_point = 0x74612a00 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 296 start_va = 0x74730000 end_va = 0x74787fff monitored = 0 entry_point = 0x747725c0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 297 start_va = 0x75160000 end_va = 0x7524afff monitored = 0 entry_point = 0x7519d650 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 298 start_va = 0x754b0000 end_va = 0x7566cfff monitored = 0 entry_point = 0x75592a10 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 299 start_va = 0x76150000 end_va = 0x761e1fff monitored = 0 entry_point = 0x76188cf0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 300 start_va = 0x4a0000 end_va = 0x4c9fff monitored = 0 entry_point = 0x4a5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 301 start_va = 0x7f0000 end_va = 0x977fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007f0000" filename = "" Region: id = 302 start_va = 0x75e50000 end_va = 0x75e7afff monitored = 0 entry_point = 0x75e55680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 303 start_va = 0x30000 end_va = 0x30fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 304 start_va = 0x4a0000 end_va = 0x4a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004a0000" filename = "" Region: id = 305 start_va = 0x980000 end_va = 0xb00fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000980000" filename = "" Region: id = 306 start_va = 0xb10000 end_va = 0x1f0ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b10000" filename = "" Region: id = 307 start_va = 0x1f10000 end_va = 0x201ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f10000" filename = "" Region: id = 308 start_va = 0x4b0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 309 start_va = 0x2020000 end_va = 0x241ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002020000" filename = "" Region: id = 310 start_va = 0x2420000 end_va = 0x2756fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 311 start_va = 0x2760000 end_va = 0x28bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002760000" filename = "" Region: id = 312 start_va = 0x757e0000 end_va = 0x757ebfff monitored = 0 entry_point = 0x757e3930 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 313 start_va = 0x706d0000 end_va = 0x70744fff monitored = 0 entry_point = 0x70709a60 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 314 start_va = 0x28c0000 end_va = 0x2a3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000028c0000" filename = "" Region: id = 315 start_va = 0x2a40000 end_va = 0x2c0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002a40000" filename = "" Region: id = 316 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 317 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 318 start_va = 0x6ce00000 end_va = 0x6ce80fff monitored = 0 entry_point = 0x6ce1b260 region_type = mapped_file name = "sxs.dll" filename = "\\Windows\\SysWOW64\\sxs.dll" (normalized: "c:\\windows\\syswow64\\sxs.dll") Region: id = 319 start_va = 0x76030000 end_va = 0x7614efff monitored = 0 entry_point = 0x76075980 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 320 start_va = 0x4d0000 end_va = 0x4d0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004d0000" filename = "" Region: id = 321 start_va = 0x4e0000 end_va = 0x4e3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004e0000" filename = "" Region: id = 322 start_va = 0x1f10000 end_va = 0x200ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f10000" filename = "" Region: id = 323 start_va = 0x2010000 end_va = 0x201ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002010000" filename = "" Region: id = 324 start_va = 0x6fff0000 end_va = 0x70006fff monitored = 0 entry_point = 0x70001790 region_type = mapped_file name = "asycfilt.dll" filename = "\\Windows\\SysWOW64\\asycfilt.dll" (normalized: "c:\\windows\\syswow64\\asycfilt.dll") Region: id = 325 start_va = 0x4f0000 end_va = 0x514fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004f0000" filename = "" Region: id = 326 start_va = 0x2760000 end_va = 0x2760fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002760000" filename = "" Region: id = 327 start_va = 0x28b0000 end_va = 0x28bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000028b0000" filename = "" Region: id = 328 start_va = 0x2760000 end_va = 0x281bfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002760000" filename = "" Region: id = 329 start_va = 0x2820000 end_va = 0x2823fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002820000" filename = "" Region: id = 330 start_va = 0x701d0000 end_va = 0x701ecfff monitored = 0 entry_point = 0x701d3b10 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 331 start_va = 0x2830000 end_va = 0x2831fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002830000" filename = "" Region: id = 332 start_va = 0x2840000 end_va = 0x2840fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002840000" filename = "" Region: id = 333 start_va = 0x2850000 end_va = 0x2854fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "user32.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\user32.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\user32.dll.mui") Region: id = 334 start_va = 0x2860000 end_va = 0x2863fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002860000" filename = "" Region: id = 335 start_va = 0x2870000 end_va = 0x2870fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002870000" filename = "" Region: id = 336 start_va = 0x748e0000 end_va = 0x7496cfff monitored = 0 entry_point = 0x74929b90 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll") Region: id = 337 start_va = 0x2880000 end_va = 0x2880fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002880000" filename = "" Region: id = 338 start_va = 0x28c0000 end_va = 0x2a14fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000028c0000" filename = "" Region: id = 339 start_va = 0x2a30000 end_va = 0x2a3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002a30000" filename = "" Region: id = 340 start_va = 0x2a40000 end_va = 0x2b8dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002a40000" filename = "" Region: id = 341 start_va = 0x2c00000 end_va = 0x2c0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002c00000" filename = "" Region: id = 342 start_va = 0x2a40000 end_va = 0x2b73fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002a40000" filename = "" Region: id = 343 start_va = 0x2c10000 end_va = 0x2d48fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002c10000" filename = "" Region: id = 344 start_va = 0x2890000 end_va = 0x2890fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002890000" filename = "" Region: id = 345 start_va = 0x75860000 end_va = 0x758e3fff monitored = 0 entry_point = 0x75886220 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 346 start_va = 0x28a0000 end_va = 0x28a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000028a0000" filename = "" Region: id = 347 start_va = 0x6cdd0000 end_va = 0x6cdfafff monitored = 0 entry_point = 0x6cdd9a70 region_type = mapped_file name = "scrrun.dll" filename = "\\Windows\\SysWOW64\\scrrun.dll" (normalized: "c:\\windows\\syswow64\\scrrun.dll") Region: id = 348 start_va = 0x6ffd0000 end_va = 0x6ffd7fff monitored = 0 entry_point = 0x6ffd17b0 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 349 start_va = 0x2a40000 end_va = 0x2a54fff monitored = 0 entry_point = 0x2a49a70 region_type = mapped_file name = "scrrun.dll" filename = "\\Windows\\SysWOW64\\scrrun.dll" (normalized: "c:\\windows\\syswow64\\scrrun.dll") Region: id = 350 start_va = 0x6cda0000 end_va = 0x6cdc2fff monitored = 0 entry_point = 0x6cda7b50 region_type = mapped_file name = "wshom.ocx" filename = "\\Windows\\SysWOW64\\wshom.ocx" (normalized: "c:\\windows\\syswow64\\wshom.ocx") Region: id = 351 start_va = 0x76370000 end_va = 0x7776efff monitored = 0 entry_point = 0x7652b990 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll") Region: id = 352 start_va = 0x6cd80000 end_va = 0x6cd95fff monitored = 0 entry_point = 0x6cd821d0 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll") Region: id = 353 start_va = 0x75300000 end_va = 0x75336fff monitored = 0 entry_point = 0x75303b50 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\SysWOW64\\cfgmgr32.dll" (normalized: "c:\\windows\\syswow64\\cfgmgr32.dll") Region: id = 354 start_va = 0x74c60000 end_va = 0x75158fff monitored = 0 entry_point = 0x74e67610 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\SysWOW64\\windows.storage.dll" (normalized: "c:\\windows\\syswow64\\windows.storage.dll") Region: id = 355 start_va = 0x75790000 end_va = 0x757d4fff monitored = 0 entry_point = 0x757ade90 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 356 start_va = 0x77770000 end_va = 0x777b3fff monitored = 0 entry_point = 0x77777410 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\SysWOW64\\powrprof.dll" (normalized: "c:\\windows\\syswow64\\powrprof.dll") Region: id = 357 start_va = 0x757f0000 end_va = 0x757fefff monitored = 0 entry_point = 0x757f2e40 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll") Region: id = 358 start_va = 0x2a20000 end_va = 0x2a2cfff monitored = 0 entry_point = 0x2a27b50 region_type = mapped_file name = "wshom.ocx" filename = "\\Windows\\SysWOW64\\wshom.ocx" (normalized: "c:\\windows\\syswow64\\wshom.ocx") Region: id = 359 start_va = 0x2a40000 end_va = 0x2a40fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002a40000" filename = "" Region: id = 360 start_va = 0x7fb00000 end_va = 0x7fea0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sysmain.sdb" filename = "\\Windows\\AppPatch\\sysmain.sdb" (normalized: "c:\\windows\\apppatch\\sysmain.sdb") Thread: id = 1 os_tid = 0xa7c [0075.039] GetVersion () returned 0x23f00206 [0075.039] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x74650000 [0075.046] GetProcAddress (hModule=0x74650000, lpProcName="IsTNT") returned 0x0 [0075.046] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0x4c0000 [0075.046] VirtualAlloc (lpAddress=0x0, dwSize=0x400000, flAllocationType=0x2000, flProtect=0x4) returned 0x2020000 [0075.047] VirtualAlloc (lpAddress=0x2020000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x2020000 [0075.049] GetCurrentThreadId () returned 0xa7c [0075.049] GetCommandLineA () returned="\"C:\\Users\\RDhJ0CNFevzX\\Desktop\\de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797.exe\" " [0075.049] GetEnvironmentStringsW () returned 0x703ba8* [0075.049] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1293, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1293 [0075.049] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x510) returned 0x4c05a8 [0075.050] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1293, lpMultiByteStr=0x4c05a8, cbMultiByte=1293, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1293 [0075.050] FreeEnvironmentStringsW (penv=0x703ba8) returned 1 [0075.050] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x480) returned 0x4c0ac0 [0075.050] GetStartupInfoA (in: lpStartupInfo=0x19f8cc | out: lpStartupInfo=0x19f8cc*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0)) [0075.050] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0075.050] GetFileType (hFile=0x0) returned 0x0 [0075.050] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0075.050] GetFileType (hFile=0x0) returned 0x0 [0075.050] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0075.050] GetFileType (hFile=0x0) returned 0x0 [0075.050] SetHandleCount (uNumber=0x20) returned 0x20 [0075.050] GetACP () returned 0x4e4 [0075.050] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x19f8f4 | out: lpCPInfo=0x19f8f4) returned 1 [0075.050] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x6610c528, nSize=0x104 | out: lpFilename="C:\\Users\\RDhJ0CNFevzX\\Desktop\\de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797.exe")) returned 0x62 [0075.052] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4c05a8 | out: hHeap=0x4c0000) returned 1 [0075.052] GetModuleHandleA (lpModuleName="KERNEL32") returned 0x74650000 [0075.053] GetProcAddress (hModule=0x74650000, lpProcName="IsProcessorFeaturePresent") returned 0x74669bf0 [0075.053] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0075.053] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x800) returned 0x4c0f48 [0075.105] CreateEventA (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0xfc [0075.105] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName=0x0) returned 0x100 [0075.106] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0075.106] GetModuleFileNameA (in: hModule=0x66000000, lpFilename=0x6610e6c8, nSize=0x104 | out: lpFilename="C:\\Windows\\SYSTEM32\\MSVBVM60.DLL" (normalized: "c:\\windows\\syswow64\\msvbvm60.dll")) returned 0x20 [0075.106] GetVersion () returned 0x23f00206 [0075.106] lstrcmpiW (lpString1="A", lpString2="B") returned -1 [0075.112] GetUserDefaultLCID () returned 0x409 [0075.112] CompareStringW (Locale=0x409, dwCmpFlags=0x30001, lpString1="A", cchCount1=-1, lpString2="B", cchCount2=-1) returned 1 [0075.112] GetSystemMetrics (nIndex=5) returned 1 [0075.113] GetSystemMetrics (nIndex=6) returned 1 [0075.113] GetSystemMetrics (nIndex=11) returned 32 [0075.113] GetSystemMetrics (nIndex=12) returned 32 [0075.113] GetSystemMetrics (nIndex=34) returned 136 [0075.113] GetSystemMetrics (nIndex=35) returned 39 [0075.113] GetSystemMetrics (nIndex=0) returned 1440 [0075.113] GetSystemMetrics (nIndex=1) returned 900 [0075.113] GetSystemMetrics (nIndex=32) returned 8 [0075.113] GetSystemMetrics (nIndex=33) returned 8 [0075.113] GetSystemMetrics (nIndex=42) returned 0 [0075.113] GetStockObject (i=15) returned 0x188000b [0075.113] GetStockObject (i=7) returned 0x1b00017 [0075.113] GetStockObject (i=6) returned 0x1b00018 [0075.113] GetStockObject (i=8) returned 0x1b00016 [0075.114] GetStockObject (i=4) returned 0x1900011 [0075.114] GetStockObject (i=2) returned 0x1900012 [0075.114] GetStockObject (i=0) returned 0x1900010 [0075.114] GetStockObject (i=5) returned 0x1900015 [0075.114] GetStockObject (i=13) returned 0x18a0048 [0075.114] GetDC (hWnd=0x0) returned 0x200106a4 [0075.114] GetTextExtentPointA (in: hdc=0x200106a4, lpString="0", c=1, lpsz=0x19f8f0 | out: lpsz=0x19f8f0) returned 1 [0075.119] GetDeviceCaps (hdc=0x200106a4, index=14) returned 1 [0075.119] GetDeviceCaps (hdc=0x200106a4, index=12) returned 32 [0075.119] GetDeviceCaps (hdc=0x200106a4, index=88) returned 96 [0075.119] GetDeviceCaps (hdc=0x200106a4, index=90) returned 96 [0075.119] GetDeviceCaps (hdc=0x200106a4, index=38) returned 32409 [0075.120] ReleaseDC (hWnd=0x0, hDC=0x200106a4) returned 1 [0075.120] HeapCreate (flOptions=0x0, dwInitialSize=0x0, dwMaximumSize=0x0) returned 0x28b0000 [0075.121] CoGetMalloc (in: dwMemContext=0x1, ppMalloc=0x6610e7d0 | out: ppMalloc=0x6610e7d0*=0x75638d00) returned 0x0 [0075.121] GetCurrentThreadId () returned 0xa7c [0075.122] GetStartupInfoA (in: lpStartupInfo=0x19ff18 | out: lpStartupInfo=0x19ff18*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0)) [0075.123] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x104) returned 0x28b05a8 [0075.123] GetCurrentThreadId () returned 0xa7c [0075.123] GetCurrentThreadId () returned 0xa7c [0075.123] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0xec8) returned 0x28b06b8 [0075.203] GetCommandLineA () returned="\"C:\\Users\\RDhJ0CNFevzX\\Desktop\\de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797.exe\" " [0075.204] lstrlenA (lpString="") returned 0 [0075.204] lstrcpyA (in: lpString1=0x19fea4, lpString2="" | out: lpString1="") returned="" [0075.204] SetErrorMode (uMode=0x8001) returned 0x0 [0075.204] GetModuleFileNameA (in: hModule=0x66000000, lpFilename=0x19fb60, nSize=0x104 | out: lpFilename="C:\\Windows\\SYSTEM32\\MSVBVM60.DLL" (normalized: "c:\\windows\\syswow64\\msvbvm60.dll")) returned 0x20 [0075.204] GetUserDefaultLCID () returned 0x409 [0075.204] lstrcpyA (in: lpString1=0x19f860, lpString2="*" | out: lpString1="*") returned="*" [0075.204] LoadStringA (in: hInstance=0x66000000, uID=0x7d1, lpBuffer=0x19fc64, cchBufferMax=8 | out: lpBuffer="409") returned 0x3 [0075.205] GetSystemDefaultLCID () returned 0x409 [0075.205] GetUserDefaultLCID () returned 0x409 [0075.205] GetLocaleInfoA (in: Locale=0x400, LCType=0xe, lpLCData=0x19fc6e, cchData=2 | out: lpLCData=".") returned 2 [0075.205] GetStockObject (i=13) returned 0x18a0048 [0075.205] GetObjectA (in: h=0x18a0048, c=60, pv=0x19fc34 | out: pv=0x19fc34) returned 60 [0075.205] GetLocaleInfoA (in: Locale=0x409, LCType=0x80000003, lpLCData=0x19fc30, cchData=4 | out: lpLCData="ENU") returned 4 [0075.205] lstrcpyA (in: lpString1=0x19fc60, lpString2="EN" | out: lpString1="EN") returned="EN" [0075.206] lstrlenA (lpString="{xx}") returned 4 [0075.206] lstrlenA (lpString="VB98.CHM") returned 8 [0075.206] lstrcpyA (in: lpString1=0x6610eae8, lpString2="VB98.CHM" | out: lpString1="VB98.CHM") returned="VB98.CHM" [0075.206] GetLocaleInfoA (in: Locale=0x409, LCType=0x80000003, lpLCData=0x19fc30, cchData=4 | out: lpLCData="ENU") returned 4 [0075.206] lstrcpyA (in: lpString1=0x19fc60, lpString2="EN" | out: lpString1="EN") returned="EN" [0075.206] lstrlenA (lpString="{xx}") returned 4 [0075.206] lstrlenA (lpString="VBENLR98.CHM") returned 12 [0075.206] lstrcpyA (in: lpString1=0x6610ebf0, lpString2="VBENLR98.CHM" | out: lpString1="VBENLR98.CHM") returned="VBENLR98.CHM" [0075.206] GetModuleFileNameA (in: hModule=0x400000, lpFilename=0x19fd88, nSize=0x104 | out: lpFilename="C:\\Users\\RDhJ0CNFevzX\\Desktop\\de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797.exe")) returned 0x62 [0075.206] GetModuleFileNameA (in: hModule=0x66000000, lpFilename=0x19fc84, nSize=0x104 | out: lpFilename="C:\\Windows\\SYSTEM32\\MSVBVM60.DLL" (normalized: "c:\\windows\\syswow64\\msvbvm60.dll")) returned 0x20 [0075.206] lstrcpynA (in: lpString1=0x19fb68, lpString2="C:\\Windows\\SYSTEM32\\MSVBVM60.DLL", iMaxLength=260 | out: lpString1="C:\\Windows\\SYSTEM32\\MSVBVM60.DLL") returned="C:\\Windows\\SYSTEM32\\MSVBVM60.DLL" [0075.206] lstrlenA (lpString="C:\\Windows\\SYSTEM32\\MSVBVM60.DLL") returned 32 [0075.206] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x21) returned 0x28b1588 [0075.206] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x21) returned 0x28b15b8 [0075.206] lstrcpyA (in: lpString1=0x28b1588, lpString2="C:\\Windows\\SYSTEM32\\MSVBVM60.DLL" | out: lpString1="C:\\Windows\\SYSTEM32\\MSVBVM60.DLL") returned="C:\\Windows\\SYSTEM32\\MSVBVM60.DLL" [0075.206] LCMapStringA (in: Locale=0x409, dwMapFlags=0x200, lpSrcStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797.exe", cchSrc=-1, lpDestStr=0x19fb48, cchDest=260 | out: lpDestStr="C:\\USERS\\RDHJ0CNFEVZX\\DESKTOP\\DE0CB500125D733BECBDEB53CF7B3F1BACE4DC91E54805007718970124EF6797.EXE") returned 99 [0075.211] InitializeSecurityDescriptor (in: pSecurityDescriptor=0x19fc4c, dwRevision=0x1 | out: pSecurityDescriptor=0x19fc4c) returned 1 [0075.211] SetSecurityDescriptorDacl (in: pSecurityDescriptor=0x19fc4c, bDaclPresent=1, pDacl=0x0, bDaclDefaulted=0 | out: pSecurityDescriptor=0x19fc4c) returned 1 [0075.211] CreateSemaphoreA (lpSemaphoreAttributes=0x19fc60, lInitialCount=0, lMaximumCount=2147483647, lpName="C:?USERS?RDHJ0CNFEVZX?DESKTOP?DE0CB500125D733BECBDEB53CF7B3F1BACE4DC91E54805007718970124EF6797.EXE") returned 0x114 [0075.212] GetLastError () returned 0x0 [0075.212] GetVersionExA (in: lpVersionInformation=0x19fbc4*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x19fbc4*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0075.212] OleInitialize (pvReserved=0x0) returned 0x0 [0076.845] OaBuildVersion () returned 0x321396 [0076.845] LoadLibraryA (lpLibFileName="OLEAUT32.DLL") returned 0x76150000 [0076.845] GetLastError () returned 0x0 [0076.845] GetProcAddress (hModule=0x76150000, lpProcName="OleLoadPictureEx") returned 0x761bba10 [0076.846] RegisterClipboardFormatA (lpszFormat="Link") returned 0xc1c6 [0076.846] RegisterClipboardFormatA (lpszFormat="Rich Text Format") returned 0xc0dc [0076.846] GetClassInfoA (in: hInstance=0x66000000, lpClassName="VBFocusRT6", lpWndClass=0x19fc2c | out: lpWndClass=0x19fc2c) returned 0 [0076.846] RegisterClassA (lpWndClass=0x19fc2c) returned 0xc1db [0076.846] GetClassInfoA (in: hInstance=0x66000000, lpClassName="VBBubbleRT6", lpWndClass=0x19fc2c | out: lpWndClass=0x19fc2c) returned 0 [0076.846] RegisterClassA (lpWndClass=0x19fc2c) returned 0xc1dc [0076.846] HeapCreate (flOptions=0x0, dwInitialSize=0x400, dwMaximumSize=0x0) returned 0x2c00000 [0076.847] GetUserDefaultLCID () returned 0x409 [0076.847] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x3a4) returned 0x28b15e8 [0076.847] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x3a4) returned 0x28b1998 [0076.847] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0xd4) returned 0x28b1d48 [0076.847] GetSystemInfo (in: lpSystemInfo=0x19fbec | out: lpSystemInfo=0x19fbec*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0076.847] VirtualAlloc (lpAddress=0x0, dwSize=0x10000, flAllocationType=0x2000, flProtect=0x4) returned 0x4b0000 [0076.848] VirtualAlloc (lpAddress=0x4b0000, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x4b0000 [0076.848] VirtualAlloc (lpAddress=0x4b0000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x4b0000 [0076.848] VirtualAlloc (lpAddress=0x4b0000, dwSize=0x3000, flAllocationType=0x1000, flProtect=0x4) returned 0x4b0000 [0076.848] VirtualAlloc (lpAddress=0x4b0000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x4b0000 [0076.849] VirtualAlloc (lpAddress=0x4b0000, dwSize=0x5000, flAllocationType=0x1000, flProtect=0x4) returned 0x4b0000 [0076.849] VirtualAlloc (lpAddress=0x4b0000, dwSize=0x6000, flAllocationType=0x1000, flProtect=0x4) returned 0x4b0000 [0076.849] VirtualProtect (in: lpAddress=0x4b0000, dwSize=0x6000, flNewProtect=0x20, lpflOldProtect=0x19fc48 | out: lpflOldProtect=0x19fc48*=0x4) returned 1 [0076.851] GetCurrentProcess () returned 0xffffffff [0076.851] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x4b0000, dwSize=0x6000) returned 1 [0076.851] GlobalAddAtomA (lpString="VBDisabled") returned 0xc086 [0076.851] GetVersion () returned 0x23f00206 [0076.851] GetModuleHandleA (lpModuleName="oleaut32.dll") returned 0x76150000 [0076.851] GetProcAddress (hModule=0x76150000, lpProcName="DispCallFunc") returned 0x7618af90 [0076.851] GetProcAddress (hModule=0x76150000, lpProcName="LoadTypeLibEx") returned 0x76171090 [0076.851] GetProcAddress (hModule=0x76150000, lpProcName="UnRegisterTypeLib") returned 0x761a17f0 [0076.852] GetProcAddress (hModule=0x76150000, lpProcName="CreateTypeLib2") returned 0x761841e0 [0076.852] GetProcAddress (hModule=0x76150000, lpProcName="VarDateFromUdate") returned 0x761768b0 [0076.852] GetProcAddress (hModule=0x76150000, lpProcName="VarUdateFromDate") returned 0x76176220 [0076.852] GetProcAddress (hModule=0x76150000, lpProcName="GetAltMonthNames") returned 0x761b7ef0 [0076.852] GetProcAddress (hModule=0x76150000, lpProcName="VarNumFromParseNum") returned 0x76165250 [0076.852] GetProcAddress (hModule=0x76150000, lpProcName="VarParseNumFromStr") returned 0x761667e0 [0076.852] GetProcAddress (hModule=0x76150000, lpProcName="VarDecFromR4") returned 0x76162400 [0076.853] GetProcAddress (hModule=0x76150000, lpProcName="VarDecFromR8") returned 0x761bc670 [0076.853] GetProcAddress (hModule=0x76150000, lpProcName="VarDecFromDate") returned 0x761bc4d0 [0076.853] GetProcAddress (hModule=0x76150000, lpProcName="VarDecFromI4") returned 0x761bc5c0 [0076.853] GetProcAddress (hModule=0x76150000, lpProcName="VarDecFromCy") returned 0x761bc490 [0076.853] GetProcAddress (hModule=0x76150000, lpProcName="VarR4FromDec") returned 0x761bcc80 [0076.853] GetProcAddress (hModule=0x76150000, lpProcName="GetRecordInfoFromTypeInfo") returned 0x76175320 [0076.853] GetProcAddress (hModule=0x76150000, lpProcName="GetRecordInfoFromGuids") returned 0x761bb5d0 [0076.853] GetProcAddress (hModule=0x76150000, lpProcName="SafeArrayGetRecordInfo") returned 0x761bbe00 [0076.854] GetProcAddress (hModule=0x76150000, lpProcName="SafeArraySetRecordInfo") returned 0x76177140 [0076.854] GetProcAddress (hModule=0x76150000, lpProcName="SafeArrayGetIID") returned 0x761bbdc0 [0076.854] GetProcAddress (hModule=0x76150000, lpProcName="SafeArraySetIID") returned 0x76174ea0 [0076.854] GetProcAddress (hModule=0x76150000, lpProcName="SafeArrayCopyData") returned 0x76165ed0 [0076.854] GetProcAddress (hModule=0x76150000, lpProcName="SafeArrayAllocDescriptorEx") returned 0x761730b0 [0076.854] GetProcAddress (hModule=0x76150000, lpProcName="SafeArrayCreateEx") returned 0x76177440 [0076.854] GetProcAddress (hModule=0x76150000, lpProcName="VarFormat") returned 0x76186fa0 [0076.854] GetProcAddress (hModule=0x76150000, lpProcName="VarFormatDateTime") returned 0x761be7b0 [0076.854] GetProcAddress (hModule=0x76150000, lpProcName="VarFormatNumber") returned 0x761be800 [0076.855] GetProcAddress (hModule=0x76150000, lpProcName="VarFormatPercent") returned 0x761be8b0 [0076.855] GetProcAddress (hModule=0x76150000, lpProcName="VarFormatCurrency") returned 0x761be6f0 [0076.855] GetProcAddress (hModule=0x76150000, lpProcName="VarWeekdayName") returned 0x761be9f0 [0076.855] GetProcAddress (hModule=0x76150000, lpProcName="VarMonthName") returned 0x761be950 [0076.855] GetProcAddress (hModule=0x76150000, lpProcName="VarAdd") returned 0x7618cbb0 [0076.855] GetProcAddress (hModule=0x76150000, lpProcName="VarAnd") returned 0x76183690 [0076.855] GetProcAddress (hModule=0x76150000, lpProcName="VarCat") returned 0x76183530 [0076.855] GetProcAddress (hModule=0x76150000, lpProcName="VarDiv") returned 0x761b2980 [0076.855] GetProcAddress (hModule=0x76150000, lpProcName="VarEqv") returned 0x761b32e0 [0076.855] GetProcAddress (hModule=0x76150000, lpProcName="VarIdiv") returned 0x761b3320 [0076.855] GetProcAddress (hModule=0x76150000, lpProcName="VarImp") returned 0x761b34a0 [0076.856] GetProcAddress (hModule=0x76150000, lpProcName="VarMod") returned 0x761b3580 [0076.856] GetProcAddress (hModule=0x76150000, lpProcName="VarMul") returned 0x7618d800 [0076.856] GetProcAddress (hModule=0x76150000, lpProcName="VarOr") returned 0x761b3790 [0076.856] GetProcAddress (hModule=0x76150000, lpProcName="VarPow") returned 0x761b2fc0 [0076.856] GetProcAddress (hModule=0x76150000, lpProcName="VarSub") returned 0x7618e0d0 [0076.856] GetProcAddress (hModule=0x76150000, lpProcName="VarXor") returned 0x761b3930 [0076.856] GetProcAddress (hModule=0x76150000, lpProcName="VarAbs") returned 0x761b1e70 [0076.856] GetProcAddress (hModule=0x76150000, lpProcName="VarFix") returned 0x761b2120 [0076.857] GetProcAddress (hModule=0x76150000, lpProcName="VarInt") returned 0x761b22c0 [0076.857] GetProcAddress (hModule=0x76150000, lpProcName="VarNeg") returned 0x761b2470 [0076.857] GetProcAddress (hModule=0x76150000, lpProcName="VarNot") returned 0x761b36e0 [0076.857] GetProcAddress (hModule=0x76150000, lpProcName="VarRound") returned 0x761b2690 [0076.857] GetProcAddress (hModule=0x76150000, lpProcName="VarCmp") returned 0x76162ae0 [0076.857] GetProcAddress (hModule=0x76150000, lpProcName="VarDecAdd") returned 0x7618a730 [0076.857] GetProcAddress (hModule=0x76150000, lpProcName="VarDecCmp") returned 0x7618af10 [0076.857] GetProcAddress (hModule=0x76150000, lpProcName="VarBstrCat") returned 0x76164cd0 [0076.857] GetProcAddress (hModule=0x76150000, lpProcName="VarCyMulI4") returned 0x7618a160 [0076.857] GetProcAddress (hModule=0x76150000, lpProcName="VarBstrCmp") returned 0x76162fd0 [0076.857] GetModuleHandleA (lpModuleName="ole32.dll") returned 0x75160000 [0076.857] GetProcAddress (hModule=0x75160000, lpProcName="CoCreateInstanceEx") returned 0x75575bc0 [0076.858] GetProcAddress (hModule=0x75160000, lpProcName="CLSIDFromProgIDEx") returned 0x75192370 [0076.858] GetSystemMetrics (nIndex=42) returned 0 [0076.858] CoGetMalloc (in: dwMemContext=0x1, ppMalloc=0x6610e688 | out: ppMalloc=0x6610e688*=0x75638d00) returned 0x0 [0076.858] IMalloc:Alloc (This=0x75638d00, cb=0x4) returned 0x6ff408 [0076.858] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x19f960, nSize=0x104 | out: lpFilename="C:\\Users\\RDhJ0CNFevzX\\Desktop\\de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797.exe")) returned 0x62 [0076.859] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797.exe", lpString2=".cfg" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797.exe.cfg") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797.exe.cfg" [0076.859] SetLastError (dwErrCode=0x0) [0076.859] SearchPathA (in: lpPath=0x0, lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797.exe.cfg", lpExtension=0x0, nBufferLength=0x103, lpBuffer=0x19f85c, lpFilePart=0x19f830 | out: lpBuffer="D´\x9fw,û\x19", lpFilePart=0x19f830*="\x8bÿU\x8bì\x83ì\x1cS\x8b]\x0cVWÆEÿ") returned 0x0 [0076.860] SetLastError (dwErrCode=0x2) [0076.860] GetLastError () returned 0x2 [0076.860] lstrcmpiA (lpString1="de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797", lpString2="MTX") returned -1 [0076.860] lstrcmpiA (lpString1="de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797", lpString2="DLLHOST") returned -1 [0076.860] lstrcmpiA (lpString1="de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797", lpString2="INETINFO") returned -1 [0076.860] lstrcmpiA (lpString1="de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797", lpString2="W3WP") returned -1 [0076.860] lstrcmpiA (lpString1="de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797", lpString2="ASPNET_WP") returned 1 [0076.860] lstrcmpiA (lpString1="de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797", lpString2="DLLHST3G") returned -1 [0076.860] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x19f954, nSize=0x104 | out: lpFilename="C:\\Users\\RDhJ0CNFevzX\\Desktop\\de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797.exe")) returned 0x62 [0076.860] lstrcmpiA (lpString1="de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797", lpString2="IEXPLORE") returned -1 [0076.860] LoadLibraryA (lpLibFileName="SXS.DLL") returned 0x6ce00000 [0077.103] GetLastError () returned 0x0 [0077.103] GetProcAddress (hModule=0x6ce00000, lpProcName="SxsOleAut32MapIIDOrCLSIDToTypeLibrary") returned 0x6ce67480 [0077.103] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fea4, cbMultiByte=-1, lpWideCharStr=0x19fea0, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0077.103] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x1c) returned 0x28b1e28 [0077.104] CoRegisterMessageFilter (in: lpMessageFilter=0x28b1e2c, lplpMessageFilter=0x28b1e34 | out: lplpMessageFilter=0x28b1e34*=0x0) returned 0x0 [0077.104] IUnknown:AddRef (This=0x28b1e2c) returned 0x2 [0077.104] GetClassInfoExA (in: hInstance=0x66000000, lpszClass="ThunderRT6Main", lpwcx=0x19fe70 | out: lpwcx=0x19fe70) returned 0 [0077.104] LoadIconA (hInstance=0x400000, lpIconName=0x1) returned 0x0 [0077.105] GetModuleHandleA (lpModuleName="USER32") returned 0x74790000 [0077.105] GetProcAddress (hModule=0x74790000, lpProcName="GetSystemMetrics") returned 0x747a9160 [0077.105] GetProcAddress (hModule=0x74790000, lpProcName="MonitorFromWindow") returned 0x747a7bd0 [0077.105] GetProcAddress (hModule=0x74790000, lpProcName="MonitorFromRect") returned 0x747b5570 [0077.105] GetProcAddress (hModule=0x74790000, lpProcName="MonitorFromPoint") returned 0x747a9440 [0077.105] GetProcAddress (hModule=0x74790000, lpProcName="EnumDisplayMonitors") returned 0x747c8d90 [0077.105] GetProcAddress (hModule=0x74790000, lpProcName="GetMonitorInfoA") returned 0x747a7e40 [0077.106] GetSystemMetrics (nIndex=0) returned 1440 [0077.106] GetSystemMetrics (nIndex=78) returned 1440 [0077.106] GetSystemMetrics (nIndex=1) returned 900 [0077.106] GetSystemMetrics (nIndex=79) returned 900 [0077.106] GetSystemMetrics (nIndex=50) returned 16 [0077.106] GetSystemMetrics (nIndex=49) returned 16 [0077.106] LoadImageA (hInst=0x400000, name=0x1, type=0x1, cx=16, cy=16, fuLoad=0x0) returned 0x0 [0077.106] RegisterClassExA (param_1=0x19fe70) returned 0xc129 [0077.106] CreateWindowExA (dwExStyle=0x80, lpClassName="ThunderRT6Main", lpWindowName=0x0, dwStyle=0x80090000, X=-2147483648, Y=-2147483648, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x66000000, lpParam=0x0) returned 0x602d2 [0077.654] NtdllDefWindowProc_A (hWnd=0x602d2, Msg=0x81, wParam=0x0, lParam=0x19f9e0) returned 0x1 [0077.661] NtdllDefWindowProc_A (hWnd=0x602d2, Msg=0x83, wParam=0x0, lParam=0x19f9cc) returned 0x0 [0077.661] NtdllDefWindowProc_A (hWnd=0x602d2, Msg=0x1, wParam=0x0, lParam=0x19f9e0) returned 0x0 [0077.662] NtdllDefWindowProc_A (hWnd=0x602d2, Msg=0x5, wParam=0x0, lParam=0x0) returned 0x0 [0077.662] NtdllDefWindowProc_A (hWnd=0x602d2, Msg=0x3, wParam=0x0, lParam=0x0) returned 0x0 [0077.662] MonitorFromWindow (hwnd=0x602d2, dwFlags=0x2) returned 0x10001 [0077.662] GetMonitorInfoA (in: hMonitor=0x10001, lpmi=0x19fe78 | out: lpmi=0x19fe78) returned 1 [0077.663] SetWindowPos (hWnd=0x602d2, hWndInsertAfter=0x0, X=720, Y=450, cx=0, cy=0, uFlags=0x1d) returned 1 [0077.663] NtdllDefWindowProc_A (hWnd=0x602d2, Msg=0x46, wParam=0x0, lParam=0x19fe1c) returned 0x0 [0077.665] NtdllDefWindowProc_A (hWnd=0x602d2, Msg=0x47, wParam=0x0, lParam=0x19fe1c) returned 0x0 [0077.665] NtdllDefWindowProc_A (hWnd=0x602d2, Msg=0x3, wParam=0x0, lParam=0x1c202d0) returned 0x0 [0077.666] ShowWindow (hWnd=0x602d2, nCmdShow=4) returned 0 [0077.666] NtdllDefWindowProc_A (hWnd=0x602d2, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0077.666] NtdllDefWindowProc_A (hWnd=0x602d2, Msg=0x46, wParam=0x0, lParam=0x19fe2c) returned 0x0 [0077.675] NtdllDefWindowProc_A (hWnd=0x602d2, Msg=0x47, wParam=0x0, lParam=0x19fe2c) returned 0x0 [0077.675] GetWindowThreadProcessId (in: hWnd=0x602d2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xa7c [0077.675] VirtualQuery (in: lpAddress=0x19fea0, lpBuffer=0x19fe84, dwLength=0x1c | out: lpBuffer=0x19fe84*(BaseAddress=0x19f000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0077.676] GetUserDefaultLCID () returned 0x409 [0077.676] IsValidCodePage (CodePage=0x3a4) returned 1 [0077.677] IsValidCodePage (CodePage=0x3b5) returned 1 [0077.677] IsValidCodePage (CodePage=0x3b6) returned 1 [0077.677] IsValidCodePage (CodePage=0x3a8) returned 1 [0077.682] GetUserDefaultLangID () returned 0x409 [0077.682] GetSystemDefaultLangID () returned 0x700409 [0077.682] GetSystemMetrics (nIndex=42) returned 0 [0077.682] IMalloc:Alloc (This=0x75638d00, cb=0xa8) returned 0x70c340 [0077.682] IMalloc:GetSize (This=0x75638d00, pv=0x70c340) returned 0xa8 [0077.683] IMalloc:Alloc (This=0x75638d00, cb=0xc) returned 0x70e978 [0077.683] GetCurrentThreadId () returned 0xa7c [0077.683] IMalloc:Alloc (This=0x75638d00, cb=0x3c) returned 0x70c3f0 [0077.683] IMalloc:Alloc (This=0x75638d00, cb=0x1c) returned 0x6fac78 [0077.684] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\VBA\\Monitors", phkResult=0x19fe6c | out: phkResult=0x19fe6c*=0x0) returned 0x2 [0077.685] IMalloc:Alloc (This=0x75638d00, cb=0x1c) returned 0x6fa9f8 [0077.685] GetCurrentThreadId () returned 0xa7c [0077.685] SetWindowsHookExA (idHook=-1, lpfn=0x66061e09, hmod=0x0, dwThreadId=0xa7c) returned 0x1100c7 [0077.686] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x14) returned 0x28b1e50 [0077.686] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x80) returned 0x28b1e70 [0077.686] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x10) returned 0x28b1ef8 [0077.686] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x2c) returned 0x28b1f10 [0077.686] GetClassInfoA (in: hInstance=0x66000000, lpClassName="VBMsoStdCompMgr", lpWndClass=0x19fdc4 | out: lpWndClass=0x19fdc4) returned 0 [0077.686] RegisterClassA (lpWndClass=0x19fdc4) returned 0xc1a9 [0077.687] CreateWindowExA (dwExStyle=0x0, lpClassName="VBMsoStdCompMgr", lpWindowName=0x0, dwStyle=0x80000000, X=-2147483648, Y=-2147483648, nWidth=-2147483648, nHeight=-2147483648, hWndParent=0x0, hMenu=0x0, hInstance=0x66000000, lpParam=0x0) returned 0x80288 [0077.687] NtdllDefWindowProc_A (hWnd=0x80288, Msg=0x81, wParam=0x0, lParam=0x19f990) returned 0x1 [0077.688] NtdllDefWindowProc_A (hWnd=0x80288, Msg=0x83, wParam=0x0, lParam=0x19f97c) returned 0x0 [0077.688] NtdllDefWindowProc_A (hWnd=0x80288, Msg=0x1, wParam=0x0, lParam=0x19f990) returned 0x0 [0077.688] NtdllDefWindowProc_A (hWnd=0x80288, Msg=0x5, wParam=0x0, lParam=0x0) returned 0x0 [0077.689] NtdllDefWindowProc_A (hWnd=0x80288, Msg=0x3, wParam=0x0, lParam=0x0) returned 0x0 [0077.689] SetWindowLongA (hWnd=0x80288, nIndex=0, dwNewLong=42671732) returned 0 [0077.689] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x38) returned 0x28b1f48 [0077.689] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x18) returned 0x28b1f88 [0077.689] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x10) returned 0x28b1fa8 [0077.689] RegisterClipboardFormatA (lpszFormat="Object Descriptor") returned 0xc00e [0077.689] RegisterClipboardFormatA (lpszFormat="Link Source Descriptor") returned 0xc00f [0077.689] RegisterClipboardFormatA (lpszFormat="Embed Source") returned 0xc00b [0077.689] RegisterClipboardFormatA (lpszFormat="Embedded Object") returned 0xc00a [0077.694] RegisterClipboardFormatA (lpszFormat="Link Source") returned 0xc00d [0077.694] RegisterClipboardFormatA (lpszFormat="OwnerLink") returned 0xc003 [0077.694] RegisterClipboardFormatA (lpszFormat="FileName") returned 0xc006 [0077.694] CreateCompatibleDC (hdc=0x0) returned 0x27010949 [0077.695] GetCurrentObject (hdc=0x27010949, type=0x7) returned 0x185000f [0077.695] CreateWindowExA (dwExStyle=0x0, lpClassName="VBFocusRT6", lpWindowName=0x0, dwStyle=0x40000000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x602d2, hMenu=0x0, hInstance=0x66000000, lpParam=0x0) returned 0x401e8 [0077.695] NtdllDefWindowProc_A (hWnd=0x401e8, Msg=0x81, wParam=0x0, lParam=0x19fa20) returned 0x1 [0077.696] NtdllDefWindowProc_A (hWnd=0x401e8, Msg=0x83, wParam=0x0, lParam=0x19fa0c) returned 0x0 [0077.696] NtdllDefWindowProc_A (hWnd=0x401e8, Msg=0x1, wParam=0x0, lParam=0x19fa20) returned 0x0 [0077.697] NtdllDefWindowProc_A (hWnd=0x401e8, Msg=0x5, wParam=0x0, lParam=0x0) returned 0x0 [0077.697] NtdllDefWindowProc_A (hWnd=0x401e8, Msg=0x3, wParam=0x0, lParam=0x0) returned 0x0 [0077.697] NtdllDefWindowProc_A (hWnd=0x602d2, Msg=0x210, wParam=0x1, lParam=0x401e8) returned 0x0 [0077.697] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x18) returned 0x28b1fc0 [0077.698] RtlAllocateHeap (HeapHandle=0x2c00000, Flags=0x8, Size=0x114) returned 0x2c005a8 [0077.698] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x5c) returned 0x28b1fe8 [0077.698] GetCurrentThreadId () returned 0xa7c [0077.698] GetCurrentThreadId () returned 0xa7c [0077.698] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x10) returned 0x28b2050 [0077.699] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x30) returned 0x28b2068 [0077.699] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x434) returned 0x28b20a0 [0077.699] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x434) returned 0x28b24e0 [0077.699] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x3c) returned 0x28b2920 [0077.699] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x114) returned 0x28b2968 [0077.699] lstrlenA (lpString="VB") returned 2 [0077.699] lstrlenA (lpString="PictureBox") returned 10 [0077.699] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0xe) returned 0x28b2a88 [0077.699] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x16c) returned 0x28b2aa0 [0077.700] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x68) returned 0x28b2c18 [0077.700] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x2c8) returned 0x28b2c88 [0077.700] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x28) returned 0x28b2f58 [0077.700] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x15) returned 0x28b2f88 [0077.700] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x28) returned 0x28b2fa8 [0077.700] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x114) returned 0x28b2fd8 [0077.701] lstrlenA (lpString="VB") returned 2 [0077.701] lstrlenA (lpString="Label") returned 5 [0077.701] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x9) returned 0x28b30f8 [0077.701] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x34) returned 0x28b3110 [0077.701] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0xf0) returned 0x28b3150 [0077.701] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x48) returned 0x28b3248 [0077.701] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x1f4) returned 0x28b3298 [0077.701] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x15) returned 0x28b3498 [0077.701] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x114) returned 0x28b34b8 [0077.701] lstrlenA (lpString="VB") returned 2 [0077.702] lstrlenA (lpString="TextBox") returned 7 [0077.702] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0xb) returned 0x28b35d8 [0077.702] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x38) returned 0x28b35f0 [0077.702] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x120) returned 0x28b3630 [0077.702] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x60) returned 0x28b3758 [0077.702] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x250) returned 0x28b37c0 [0077.702] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x15) returned 0x28b3a18 [0077.702] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x114) returned 0x28b3a38 [0077.702] lstrlenA (lpString="VB") returned 2 [0077.702] lstrlenA (lpString="Frame") returned 5 [0077.702] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x9) returned 0x28b3b58 [0077.702] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x24) returned 0x28b3b70 [0077.703] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0xb0) returned 0x28b3ba0 [0077.703] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x34) returned 0x28b3c58 [0077.703] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x184) returned 0x28b3c98 [0077.703] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x15) returned 0x28b3e28 [0077.703] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x114) returned 0x28b3e48 [0077.703] lstrlenA (lpString="VB") returned 2 [0077.703] lstrlenA (lpString="CommandButton") returned 13 [0077.703] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x11) returned 0x28b3f68 [0077.704] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x28) returned 0x28b3f88 [0077.704] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0xd4) returned 0x28b3fb8 [0077.704] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x44) returned 0x28b4098 [0077.705] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x1c8) returned 0x28b40e8 [0077.705] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x15) returned 0x28b42b8 [0077.705] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x114) returned 0x28b42d8 [0077.705] lstrlenA (lpString="VB") returned 2 [0077.705] lstrlenA (lpString="CheckBox") returned 8 [0077.705] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0xc) returned 0x28b43f8 [0077.705] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x28) returned 0x28b4410 [0077.705] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0xec) returned 0x28b4440 [0077.705] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x48) returned 0x28b4538 [0077.705] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x1f8) returned 0x28b4588 [0077.705] RtlReAllocateHeap (Heap=0x28b0000, Flags=0x0, Ptr=0x28b2f58, Size=0x50) returned 0x28b4788 [0077.705] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x15) returned 0x28b2f58 [0077.706] RtlReAllocateHeap (Heap=0x28b0000, Flags=0x0, Ptr=0x28b2fa8, Size=0x50) returned 0x28b47e0 [0077.707] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x114) returned 0x28b4838 [0077.707] lstrlenA (lpString="VB") returned 2 [0077.707] lstrlenA (lpString="OptionButton") returned 12 [0077.707] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x10) returned 0x28b2fa8 [0077.707] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x28) returned 0x28b4958 [0077.707] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0xd4) returned 0x28b4988 [0077.707] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x4c) returned 0x28b4a68 [0077.707] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x1c8) returned 0x28b4ac0 [0077.707] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x15) returned 0x28b4c90 [0077.707] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x114) returned 0x28b4cb0 [0077.707] lstrlenA (lpString="VB") returned 2 [0077.707] lstrlenA (lpString="ComboBox") returned 8 [0077.707] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0xc) returned 0x28b2fc0 [0077.707] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x108) returned 0x28b4dd0 [0077.707] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x4c) returned 0x28b4ee0 [0077.708] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x230) returned 0x28b4f38 [0077.708] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x15) returned 0x28b5170 [0077.708] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x114) returned 0x28b5190 [0077.708] lstrlenA (lpString="VB") returned 2 [0077.708] lstrlenA (lpString="ListBox") returned 7 [0077.708] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0xb) returned 0x28b52b0 [0077.708] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x108) returned 0x28b52c8 [0077.708] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x54) returned 0x28b53d8 [0077.708] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x230) returned 0x28b5438 [0077.709] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x15) returned 0x28b5670 [0077.709] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x114) returned 0x28b5690 [0077.709] lstrlenA (lpString="VB") returned 2 [0077.709] lstrlenA (lpString="Timer") returned 5 [0077.709] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x9) returned 0x28b57b0 [0077.709] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0xc) returned 0x28b57c8 [0077.709] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x30) returned 0x28b57e0 [0077.709] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x4) returned 0x28b2f78 [0077.709] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x9c) returned 0x28b5818 [0077.709] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x15) returned 0x28b58c0 [0077.709] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x114) returned 0x28b58e0 [0077.709] lstrlenA (lpString="VB") returned 2 [0077.710] lstrlenA (lpString="Printer") returned 7 [0077.710] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0xb) returned 0x28b5a00 [0077.710] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0xdc) returned 0x28b5a18 [0077.710] RtlReAllocateHeap (Heap=0x28b0000, Flags=0x0, Ptr=0x28b4788, Size=0x78) returned 0x28b5b00 [0077.710] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x15) returned 0x28b4788 [0077.710] RtlReAllocateHeap (Heap=0x28b0000, Flags=0x0, Ptr=0x28b47e0, Size=0x78) returned 0x28b5b80 [0077.710] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x114) returned 0x28b5c00 [0077.710] lstrlenA (lpString="VB") returned 2 [0077.710] lstrlenA (lpString="Form") returned 4 [0077.710] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x8) returned 0x28b47a8 [0077.710] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x184) returned 0x28b5d20 [0077.710] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x7c) returned 0x28b5eb0 [0077.710] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x2f8) returned 0x28b5f38 [0077.711] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x15) returned 0x28b47b8 [0077.711] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x114) returned 0x28b6238 [0077.711] lstrlenA (lpString="VB") returned 2 [0077.711] lstrlenA (lpString="Screen") returned 6 [0077.711] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0xa) returned 0x28b47d8 [0077.711] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x2c) returned 0x28b47f0 [0077.711] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0xa0) returned 0x28b6358 [0077.712] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x15) returned 0x28b6400 [0077.712] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x114) returned 0x28b9350 [0077.713] lstrlenA (lpString="VB") returned 2 [0077.713] lstrlenA (lpString="Clipboard") returned 9 [0077.713] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0xd) returned 0x28b04a0 [0077.713] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x1c) returned 0x28b04b8 [0077.714] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x68) returned 0x28b04e0 [0077.714] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x15) returned 0x28b0550 [0077.714] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x114) returned 0x28b9470 [0077.714] lstrlenA (lpString="VB") returned 2 [0077.714] lstrlenA (lpString="Menu") returned 4 [0077.714] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x8) returned 0x28b4828 [0077.714] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x38) returned 0x28b9590 [0077.714] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x4) returned 0x28b0570 [0077.714] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0xb8) returned 0x28b95d0 [0077.714] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x15) returned 0x28b9718 [0077.714] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x114) returned 0x28b9e98 [0077.715] lstrlenA (lpString="VB") returned 2 [0077.715] lstrlenA (lpString="MDIForm") returned 7 [0077.715] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0xb) returned 0x28b0580 [0077.715] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x184) returned 0x28b9fb8 [0077.715] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x7c) returned 0x28ba148 [0077.715] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x2f8) returned 0x28ba1d0 [0077.715] RtlReAllocateHeap (Heap=0x28b0000, Flags=0x0, Ptr=0x28b5b00, Size=0xa0) returned 0x28ba4d0 [0077.715] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x15) returned 0x28b9958 [0077.715] RtlReAllocateHeap (Heap=0x28b0000, Flags=0x0, Ptr=0x28b5b80, Size=0xa0) returned 0x28ba578 [0077.715] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x114) returned 0x28ba620 [0077.715] lstrlenA (lpString="VB") returned 2 [0077.715] lstrlenA (lpString="App") returned 3 [0077.715] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x7) returned 0x28b0598 [0077.715] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x84) returned 0x28b5b00 [0077.715] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x148) returned 0x28ba740 [0077.736] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x15) returned 0x28b9858 [0077.736] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x114) returned 0x28bb570 [0077.736] lstrlenA (lpString="VB") returned 2 [0077.736] lstrlenA (lpString="UserControl") returned 11 [0077.736] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0xf) returned 0x28bba28 [0077.737] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x1e4) returned 0x28bbaa0 [0077.737] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0xb0) returned 0x28bbc90 [0077.737] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x3a4) returned 0x28bbd48 [0077.737] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x15) returned 0x28b9878 [0077.737] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x114) returned 0x28bab08 [0077.737] lstrlenA (lpString="VB") returned 2 [0077.737] lstrlenA (lpString="PropertyPage") returned 12 [0077.737] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x10) returned 0x28bba40 [0077.737] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x190) returned 0x28bc0f8 [0077.737] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x88) returned 0x28bc290 [0077.737] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x310) returned 0x28bc320 [0077.738] lstrcmpiA (lpString1="VB.MDIForm", lpString2="VB.PropertyPage") returned -1 [0077.738] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x15) returned 0x28b9838 [0077.738] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x114) returned 0x28bb0d0 [0077.738] lstrlenA (lpString="VB") returned 2 [0077.738] lstrlenA (lpString="UserDocument") returned 12 [0077.738] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x10) returned 0x28bb8f0 [0077.738] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x1c8) returned 0x28bc638 [0077.738] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0xa8) returned 0x28bc808 [0077.738] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x370) returned 0x28bc8b8 [0077.739] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x15) returned 0x28b9998 [0077.739] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x20) returned 0x28b5b90 [0077.742] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x238) returned 0x28bcc30 [0077.742] lstrlenA (lpString="Enabled") returned 7 [0077.743] lstrlenA (lpString="DataSource") returned 10 [0077.744] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x114) returned 0x28bb448 [0077.745] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x14) returned 0x28b9a38 [0077.745] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x140) returned 0x28bce70 [0077.745] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x24) returned 0x28b5bb8 [0077.745] RtlReAllocateHeap (Heap=0x28b0000, Flags=0x0, Ptr=0x28ba4d0, Size=0xc8) returned 0x28bcfb8 [0077.745] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x15) returned 0x28b9a18 [0077.746] RtlReAllocateHeap (Heap=0x28b0000, Flags=0x0, Ptr=0x28ba578, Size=0xc8) returned 0x28bd088 [0077.746] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x148) returned 0x28ba4d0 [0077.746] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x114) returned 0x28bb698 [0077.746] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x12c) returned 0x28bd158 [0077.746] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x24) returned 0x28bd290 [0077.746] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x15) returned 0x28b9978 [0077.746] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x258) returned 0x28bd2c0 [0077.746] lstrlenA (lpString="Enabled") returned 7 [0077.746] lstrlenA (lpString="HotTracking") returned 11 [0077.746] lstrlenA (lpString="MultiSelect") returned 11 [0077.746] lstrlenA (lpString="Separators") returned 10 [0077.746] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x114) returned 0x28ba8b8 [0077.747] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x14) returned 0x28b99d8 [0077.747] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x140) returned 0x28bd520 [0077.747] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x24) returned 0x28bd668 [0077.747] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x15) returned 0x28b9918 [0077.747] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x218) returned 0x28bd698 [0077.747] lstrlenA (lpString="Enabled") returned 7 [0077.747] lstrlenA (lpString="BorderStyle") returned 11 [0077.747] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x114) returned 0x28bac30 [0077.747] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x10) returned 0x28bb980 [0077.747] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x13c) returned 0x28bd8b8 [0077.747] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x24) returned 0x28bda00 [0077.747] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x15) returned 0x28b9a78 [0077.747] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x1d0) returned 0x28bda30 [0077.748] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x114) returned 0x28bad58 [0077.748] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x10) returned 0x28bb968 [0077.748] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x13c) returned 0x28bdc08 [0077.748] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x24) returned 0x28bdd50 [0077.748] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x15) returned 0x28b9898 [0077.748] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x1c0) returned 0x28bdd80 [0077.748] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x114) returned 0x28ba9e0 [0077.748] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x10) returned 0x28bba70 [0077.748] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x13c) returned 0x28bdf48 [0077.748] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x24) returned 0x28be090 [0077.749] RtlReAllocateHeap (Heap=0x28b0000, Flags=0x0, Ptr=0x28bcfb8, Size=0xf0) returned 0x28be0c0 [0077.749] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x15) returned 0x28b96d8 [0077.749] RtlReAllocateHeap (Heap=0x28b0000, Flags=0x0, Ptr=0x28bd088, Size=0xf0) returned 0x28be1b8 [0077.749] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x1f0) returned 0x28be2b0 [0077.749] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x114) returned 0x28bae80 [0077.749] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x14) returned 0x28b96f8 [0077.749] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x140) returned 0x28bcfb8 [0077.749] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x24) returned 0x28bd100 [0077.749] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x15) returned 0x28b98b8 [0077.749] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x1f0) returned 0x28be4a8 [0077.749] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x114) returned 0x28bb1f8 [0077.749] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x14) returned 0x28b99b8 [0077.749] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x140) returned 0x28be6a0 [0077.750] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x24) returned 0x28be7e8 [0077.750] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x15) returned 0x28b96b8 [0077.750] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x148) returned 0x28be818 [0077.750] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x114) returned 0x28bafa8 [0077.750] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x12c) returned 0x28be968 [0077.750] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x24) returned 0x28beaa0 [0077.750] lstrcmpiA (lpString1="VB.Form", lpString2="MSComctlLib.ImageList") returned 1 [0077.750] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x15) returned 0x28b9798 [0077.751] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x1f0) returned 0x28bead0 [0077.751] lstrlenA (lpString="Enabled") returned 7 [0077.751] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x114) returned 0x28bb320 [0077.751] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x14) returned 0x28b9a58 [0077.751] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x140) returned 0x28becc8 [0077.751] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x24) returned 0x28bee10 [0077.751] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x15) returned 0x28b9738 [0077.751] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x1a0) returned 0x28bee40 [0077.751] lstrlenA (lpString="Text") returned 4 [0077.751] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x114) returned 0x1f111c8 [0077.753] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x14) returned 0x28b97d8 [0077.753] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x140) returned 0x1f12050 [0077.753] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x24) returned 0x1f12198 [0077.753] RtlReAllocateHeap (Heap=0x28b0000, Flags=0x0, Ptr=0x28be0c0, Size=0x118) returned 0x1f121c8 [0077.753] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x15) returned 0x28b99f8 [0077.753] RtlReAllocateHeap (Heap=0x28b0000, Flags=0x0, Ptr=0x28be1b8, Size=0x118) returned 0x1f122e8 [0077.753] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x1c0) returned 0x28be0c0 [0077.753] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x114) returned 0x1f112f0 [0077.753] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x14) returned 0x28b98d8 [0077.753] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x140) returned 0x1f12408 [0077.753] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x24) returned 0x1f12550 [0077.754] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x15) returned 0x28b9938 [0077.754] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x1b8) returned 0x1f12580 [0077.754] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x114) returned 0x1f11b08 [0077.754] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x14) returned 0x28b98f8 [0077.754] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x140) returned 0x1f12740 [0077.754] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x24) returned 0x1f12888 [0077.754] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x15) returned 0x28b9758 [0077.755] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x208) returned 0x1f128b8 [0077.755] lstrlenA (lpString="Value") returned 5 [0077.755] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x114) returned 0x1f11418 [0077.755] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x14) returned 0x28b9778 [0077.755] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x140) returned 0x1f12ac8 [0077.755] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x24) returned 0x1f12d88 [0077.755] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x15) returned 0x28b97b8 [0077.755] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x208) returned 0x1f13018 [0077.755] lstrlenA (lpString="Value") returned 5 [0077.755] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x114) returned 0x1f11790 [0077.755] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x14) returned 0x28b97f8 [0077.755] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x140) returned 0x1f13228 [0077.755] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x24) returned 0x1f12ed8 [0077.756] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x15) returned 0x28b9818 [0077.756] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x160) returned 0x1f13370 [0077.756] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x114) returned 0x1f11540 [0077.756] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x10) returned 0x28bba58 [0077.756] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x13c) returned 0x1f134d8 [0077.756] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x24) returned 0x1f12db8 [0077.756] RtlReAllocateHeap (Heap=0x28b0000, Flags=0x0, Ptr=0x1f121c8, Size=0x140) returned 0x1f13620 [0077.756] lstrcmpiA (lpString1="VB.Form", lpString2="MSComCtl2.FlatScrollBar") returned 1 [0077.756] lstrcmpiA (lpString1="MSComctlLib.ImageList", lpString2="MSComCtl2.FlatScrollBar") returned 1 [0077.756] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x15) returned 0x1f13df8 [0077.756] RtlReAllocateHeap (Heap=0x28b0000, Flags=0x0, Ptr=0x1f122e8, Size=0x140) returned 0x1f13f70 [0077.757] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x150) returned 0x1f121c8 [0077.757] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x114) returned 0x1f11668 [0077.757] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x12c) returned 0x1f140b8 [0077.757] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x24) returned 0x1f12de8 [0077.757] lstrcmpiA (lpString1="VB.CommandButton", lpString2="InetCtlsObjects.Inet") returned 1 [0077.757] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x15) returned 0x1f13f38 [0077.758] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x228) returned 0x1f141f0 [0077.758] lstrlenA (lpString="BackColor") returned 9 [0077.758] lstrlenA (lpString="Enabled") returned 7 [0077.758] lstrlenA (lpString="TextRTF") returned 7 [0077.758] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x114) returned 0x1f10e50 [0077.758] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x14) returned 0x1f13cf8 [0077.758] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x140) returned 0x1f14420 [0077.758] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x24) returned 0x1f12e78 [0077.758] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x15) returned 0x1f13d58 [0077.758] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x330) returned 0x1f14568 [0077.758] lstrlenA (lpString="BorderStyle") returned 11 [0077.758] lstrlenA (lpString="Enabled") returned 7 [0077.758] lstrlenA (lpString="DataSource") returned 10 [0077.758] lstrlenA (lpString="DataMember") returned 10 [0077.758] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x114) returned 0x1f118b8 [0077.758] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x14) returned 0x1f13db8 [0077.759] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x140) returned 0x1f14ca0 [0077.759] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x24) returned 0x1f12f38 [0077.759] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x15) returned 0x1f13d18 [0077.759] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x168) returned 0x1f158a8 [0077.760] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x114) returned 0x1f10510 [0077.760] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x12c) returned 0x1f15a18 [0077.760] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x24) returned 0x1f12f68 [0077.760] lstrcmpiA (lpString1="MSFlexGridLib.MSFlexGrid", lpString2="MSWinsockLib.Winsock") returned -1 [0077.760] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x15) returned 0x1f13bd8 [0077.760] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x148) returned 0x1f15b50 [0077.760] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x114) returned 0x1f119e0 [0077.760] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x12c) returned 0x1f15ca0 [0077.760] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x24) returned 0x1f12cf8 [0077.760] RtlReAllocateHeap (Heap=0x28b0000, Flags=0x0, Ptr=0x1f13620, Size=0x168) returned 0x1f15dd8 [0077.760] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x15) returned 0x1f13e18 [0077.760] RtlReAllocateHeap (Heap=0x28b0000, Flags=0x0, Ptr=0x1f13f70, Size=0x168) returned 0x1f15f48 [0077.761] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x148) returned 0x1f160b8 [0077.761] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x114) returned 0x1f11c30 [0077.761] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x12c) returned 0x1f13f70 [0077.761] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x24) returned 0x1f12d28 [0077.761] lstrcmpiA (lpString1="MSMAPI.MAPISession", lpString2="MSMAPI.MAPIMessages") returned 1 [0077.761] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x15) returned 0x1f13b98 [0077.761] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x218) returned 0x1f16208 [0077.761] lstrlenA (lpString="BorderStyle") returned 11 [0077.761] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x114) returned 0x1f110a0 [0077.762] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x14) returned 0x1f13c78 [0077.762] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x140) returned 0x1f156e0 [0077.762] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x24) returned 0x1f12cc8 [0077.762] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x15) returned 0x1f13e38 [0077.762] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x148) returned 0x1f16428 [0077.762] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x114) returned 0x1f10888 [0077.762] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x12c) returned 0x1f13620 [0077.762] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x24) returned 0x1f12d58 [0077.763] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x15) returned 0x1f13ef8 [0077.763] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x130) returned 0x1f16578 [0077.763] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x114) returned 0x1f10f78 [0077.763] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x12c) returned 0x1f166b0 [0077.763] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x24) returned 0x1f12e18 [0077.763] lstrcmpiA (lpString1="VB.Form", lpString2="MSCommLib.MSComm") returned 1 [0077.763] lstrcmpiA (lpString1="MSComctlLib.ImageList", lpString2="MSCommLib.MSComm") returned -1 [0077.763] lstrcmpiA (lpString1="MSComCtl2.FlatScrollBar", lpString2="MSCommLib.MSComm") returned -1 [0077.763] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x15) returned 0x1f13e98 [0077.764] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x220) returned 0x1f167e8 [0077.764] lstrlenA (lpString="Text") returned 4 [0077.764] lstrlenA (lpString="BackColor") returned 9 [0077.764] lstrlenA (lpString="ForeColor") returned 9 [0077.764] lstrlenA (lpString="Enabled") returned 7 [0077.764] lstrlenA (lpString="BorderStyle") returned 11 [0077.764] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x114) returned 0x1f10638 [0077.764] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x14) returned 0x1f13c58 [0077.764] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x140) returned 0x1f14f30 [0077.764] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x24) returned 0x1f12f98 [0077.764] RtlReAllocateHeap (Heap=0x28b0000, Flags=0x0, Ptr=0x1f15dd8, Size=0x190) returned 0x1f16a10 [0077.764] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x15) returned 0x1f13bb8 [0077.764] RtlReAllocateHeap (Heap=0x28b0000, Flags=0x0, Ptr=0x1f15f48, Size=0x190) returned 0x1f16ba8 [0077.764] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x498) returned 0x1f16d40 [0077.765] lstrlenA (lpString="AllowAddNew") returned 11 [0077.765] lstrlenA (lpString="AllowArrows") returned 11 [0077.765] lstrlenA (lpString="AllowDelete") returned 11 [0077.765] lstrlenA (lpString="AllowUpdate") returned 11 [0077.765] lstrlenA (lpString="Appearance") returned 10 [0077.765] lstrlenA (lpString="BackColor") returned 9 [0077.765] lstrlenA (lpString="BorderStyle") returned 11 [0077.765] lstrlenA (lpString="ColumnHeaders") returned 13 [0077.765] lstrlenA (lpString="DataSource") returned 10 [0077.765] lstrlenA (lpString="DataMember") returned 10 [0077.765] lstrlenA (lpString="DefColWidth") returned 11 [0077.765] lstrlenA (lpString="ForeColor") returned 9 [0077.765] lstrlenA (lpString="RightToLeft") returned 11 [0077.765] lstrlenA (lpString="TabAcrossSplits") returned 15 [0077.765] lstrlenA (lpString="TabAction") returned 9 [0077.765] lstrlenA (lpString="WrapCellPointer") returned 15 [0077.765] lstrlenA (lpString="DataFormats") returned 11 [0077.766] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x114) returned 0x1f11d58 [0077.766] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x14) returned 0x1f13bf8 [0077.766] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x140) returned 0x1f148c8 [0077.766] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x24) returned 0x1f12e48 [0077.766] lstrcmpiA (lpString1="VB.MDIForm", lpString2="MSDataGridLib.DataGrid") returned 1 [0077.766] lstrcmpiA (lpString1="VB.PropertyPage", lpString2="MSDataGridLib.DataGrid") returned 1 [0077.766] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x15) returned 0x1f13c98 [0077.766] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x238) returned 0x1f15dd8 [0077.766] lstrlenA (lpString="BoundText") returned 9 [0077.766] lstrlenA (lpString="RowSource") returned 9 [0077.766] lstrlenA (lpString="RowMember") returned 9 [0077.766] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x114) returned 0x1f11e80 [0077.766] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x14) returned 0x1f13dd8 [0077.766] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x140) returned 0x1f14a10 [0077.766] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x24) returned 0x1f12fc8 [0077.767] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x15) returned 0x1f13c18 [0077.767] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x240) returned 0x1f171e0 [0077.767] lstrlenA (lpString="BoundText") returned 9 [0077.767] lstrlenA (lpString="RowSource") returned 9 [0077.767] lstrlenA (lpString="RowMember") returned 9 [0077.767] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x114) returned 0x1f10ad8 [0077.767] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x14) returned 0x1f13d78 [0077.767] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x140) returned 0x1f14de8 [0077.767] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x24) returned 0x1f12ea8 [0077.767] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x15) returned 0x1f13d98 [0077.768] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x158) returned 0x1f17428 [0077.768] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x114) returned 0x1f10070 [0077.768] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x10) returned 0x28bba88 [0077.768] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x13c) returned 0x1f15450 [0077.768] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x24) returned 0x1f12f08 [0077.768] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x15) returned 0x1f13e58 [0077.768] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x2c0) returned 0x1f17588 [0077.768] lstrlenA (lpString="FontBand") returned 8 [0077.768] lstrlenA (lpString="FontHeader") returned 10 [0077.768] lstrlenA (lpString="Enabled") returned 7 [0077.768] lstrlenA (lpString="DataSource") returned 10 [0077.768] lstrlenA (lpString="DataMember") returned 10 [0077.768] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x114) returned 0x1f10198 [0077.768] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x14) returned 0x1f13e78 [0077.768] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x140) returned 0x1f15078 [0077.768] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x24) returned 0x1f12c38 [0077.769] RtlReAllocateHeap (Heap=0x28b0000, Flags=0x0, Ptr=0x1f16a10, Size=0x1b8) returned 0x1f17850 [0077.769] lstrcmpiA (lpString1="VB.CommandButton", lpString2="MSHierarchicalFlexGridLib.MSHFlexGrid") returned 1 [0077.769] lstrcmpiA (lpString1="InetCtlsObjects.Inet", lpString2="MSHierarchicalFlexGridLib.MSHFlexGrid") returned -1 [0077.769] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x15) returned 0x1f13eb8 [0077.769] RtlReAllocateHeap (Heap=0x28b0000, Flags=0x0, Ptr=0x1f16ba8, Size=0x1b8) returned 0x1f17a10 [0077.769] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x120) returned 0x1f16a10 [0077.769] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x114) returned 0x1f10760 [0077.769] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x14) returned 0x1f13ed8 [0077.769] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x140) returned 0x1f151c0 [0077.769] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x24) returned 0x1f12c68 [0077.770] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x15) returned 0x1f13f18 [0077.770] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x128) returned 0x1f16b38 [0077.770] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x114) returned 0x1f109b0 [0077.770] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x14) returned 0x1f13d38 [0077.770] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x140) returned 0x1f15598 [0077.770] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x24) returned 0x1f12c98 [0077.770] lstrcmpiA (lpString1="MSComctlLib.Toolbar", lpString2="Boton2007.Boton") returned 1 [0077.770] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x15) returned 0x1f13c38 [0077.770] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x148) returned 0x1f17bd0 [0077.770] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x114) returned 0x1f102c0 [0077.771] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x14) returned 0x1f13cb8 [0077.771] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x140) returned 0x1f15308 [0077.771] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x24) returned 0x1f18110 [0077.771] lstrcmpiA (lpString1="MSComctlLib.TreeView", lpString2="Proyecto1.ButtonOffice") returned -1 [0077.771] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x15) returned 0x1f13cd8 [0077.773] RtlAllocateHeap (HeapHandle=0x2c00000, Flags=0x8, Size=0x30) returned 0x2c006c8 [0077.774] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0xa0) returned 0x1f16c68 [0077.774] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x28) returned 0x1f17e10 [0077.774] GetCurrentThreadId () returned 0xa7c [0077.774] GetCurrentThreadId () returned 0xa7c [0077.774] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x10) returned 0x28bb8d8 [0077.775] RtlAllocateHeap (HeapHandle=0x2c00000, Flags=0x8, Size=0x30) returned 0x2c00700 [0077.775] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0xa0) returned 0x1f12320 [0077.776] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x28) returned 0x1f18140 [0077.776] GetCurrentThreadId () returned 0xa7c [0077.776] GetCurrentThreadId () returned 0xa7c [0077.776] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x10) returned 0x28bb998 [0077.776] RtlAllocateHeap (HeapHandle=0x2c00000, Flags=0x8, Size=0x30) returned 0x2c00738 [0077.776] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0xa0) returned 0x1f18528 [0077.776] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x28) returned 0x1f18320 [0077.776] GetCurrentThreadId () returned 0xa7c [0077.776] GetCurrentThreadId () returned 0xa7c [0077.776] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x10) returned 0x28bb908 [0077.776] RtlAllocateHeap (HeapHandle=0x2c00000, Flags=0x8, Size=0x30) returned 0x2c00770 [0077.776] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0xa0) returned 0x1f185d0 [0077.776] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x28) returned 0x1f18260 [0077.776] GetCurrentThreadId () returned 0xa7c [0077.776] GetCurrentThreadId () returned 0xa7c [0077.776] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x10) returned 0x28bb8c0 [0077.776] RtlAllocateHeap (HeapHandle=0x2c00000, Flags=0x8, Size=0x30) returned 0x2c007a8 [0077.776] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0xa0) returned 0x1f18678 [0077.777] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x28) returned 0x1f17e40 [0077.777] GetCurrentThreadId () returned 0xa7c [0077.777] GetCurrentThreadId () returned 0xa7c [0077.777] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x10) returned 0x28bb9b0 [0077.777] RtlAllocateHeap (HeapHandle=0x2c00000, Flags=0x8, Size=0x30) returned 0x2c007e0 [0077.777] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0xa0) returned 0x1f18720 [0077.777] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x28) returned 0x1f18200 [0077.777] GetCurrentThreadId () returned 0xa7c [0077.777] GetCurrentThreadId () returned 0xa7c [0077.777] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x10) returned 0x28bb9c8 [0077.777] RtlAllocateHeap (HeapHandle=0x2c00000, Flags=0x8, Size=0x30) returned 0x2c00818 [0077.777] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0xa0) returned 0x1f187c8 [0077.777] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x28) returned 0x1f182c0 [0077.777] GetCurrentThreadId () returned 0xa7c [0077.777] GetCurrentThreadId () returned 0xa7c [0077.777] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x10) returned 0x28bb920 [0077.777] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x114) returned 0x1f103e8 [0077.778] lstrlenA (lpString="VB") returned 2 [0077.778] lstrlenA (lpString="HScrollBar") returned 10 [0077.778] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0xe) returned 0x28bb9e0 [0077.778] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x24) returned 0x1f18050 [0077.778] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x90) returned 0x1f16018 [0077.778] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x28) returned 0x1f17d50 [0077.778] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x144) returned 0x1f18870 [0077.778] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x15) returned 0x1f13a58 [0077.778] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x114) returned 0x1f10c00 [0077.778] lstrlenA (lpString="VB") returned 2 [0077.778] lstrlenA (lpString="VScrollBar") returned 10 [0077.778] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0xe) returned 0x28bb938 [0077.778] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x24) returned 0x1f17e70 [0077.778] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x90) returned 0x1f189c0 [0077.778] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x28) returned 0x1f181a0 [0077.822] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x144) returned 0x1f18a58 [0077.822] RtlReAllocateHeap (Heap=0x28b0000, Flags=0x0, Ptr=0x1f17850, Size=0x1e0) returned 0x1f18ba8 [0077.822] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x15) returned 0x1f138b8 [0077.822] RtlReAllocateHeap (Heap=0x28b0000, Flags=0x0, Ptr=0x1f17a10, Size=0x1e0) returned 0x1f18d90 [0077.822] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x114) returned 0x1f10d28 [0077.822] lstrlenA (lpString="VB") returned 2 [0077.822] lstrlenA (lpString="DriveListBox") returned 12 [0077.822] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x10) returned 0x28bb9f8 [0077.822] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x28) returned 0x1f17ff0 [0077.822] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0xc0) returned 0x1f17850 [0077.822] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x40) returned 0x1f18f78 [0077.822] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x1a0) returned 0x1f17918 [0077.823] lstrcmpiA (lpString1="MSComctlLib.ImageCombo", lpString2="VB.DriveListBox") returned -1 [0077.823] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x15) returned 0x1f13af8 [0077.823] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x114) returned 0x1f1a708 [0077.824] lstrlenA (lpString="VB") returned 2 [0077.824] lstrlenA (lpString="DirListBox") returned 10 [0077.824] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0xe) returned 0x28bb950 [0077.824] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x28) returned 0x1f17db0 [0077.824] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0xc8) returned 0x1f17ac0 [0077.824] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x50) returned 0x1f1afc8 [0077.824] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x1b0) returned 0x1f1b020 [0077.824] lstrcmpiA (lpString1="MSMask.MaskEdBox", lpString2="VB.DirListBox") returned -1 [0077.825] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x15) returned 0x1f13b38 [0077.825] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x114) returned 0x1f1adf8 [0077.825] lstrlenA (lpString="VB") returned 2 [0077.825] lstrlenA (lpString="FileListBox") returned 11 [0077.825] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0xf) returned 0x28bba10 [0077.825] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x28) returned 0x1f17d80 [0077.825] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0xec) returned 0x1f1b1d8 [0077.825] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x58) returned 0x1f1b2d0 [0077.825] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x1f8) returned 0x1f1b330 [0077.825] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x15) returned 0x1f13798 [0077.826] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x114) returned 0x1f1a018 [0077.826] lstrlenA (lpString="VB") returned 2 [0077.826] lstrlenA (lpString="Shape") returned 5 [0077.826] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x9) returned 0x1f1b650 [0077.826] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x1c) returned 0x28be288 [0077.826] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x68) returned 0x1f1b938 [0077.826] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0xfc) returned 0x1f1b9a8 [0077.826] lstrcmpiA (lpString1="MSComCtl2.MonthView", lpString2="VB.Shape") returned -1 [0077.826] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x15) returned 0x1f137f8 [0077.826] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x114) returned 0x1f19a50 [0077.826] lstrlenA (lpString="VB") returned 2 [0077.826] lstrlenA (lpString="Line") returned 4 [0077.826] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x8) returned 0x1f13758 [0077.827] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x18) returned 0x1f13a38 [0077.827] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x50) returned 0x1f1bab0 [0077.827] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0xd0) returned 0x1f1bb08 [0077.827] RtlReAllocateHeap (Heap=0x28b0000, Flags=0x0, Ptr=0x1f18ba8, Size=0x208) returned 0x1f1bbe0 [0077.827] lstrcmpiA (lpString1="MCI.MMControl", lpString2="VB.Line") returned -1 [0077.827] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x15) returned 0x1f13a78 [0077.827] RtlReAllocateHeap (Heap=0x28b0000, Flags=0x0, Ptr=0x1f18d90, Size=0x208) returned 0x1f1bdf0 [0077.828] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x114) returned 0x1f195b0 [0077.828] lstrlenA (lpString="VB") returned 2 [0077.828] lstrlenA (lpString="Image") returned 5 [0077.828] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x9) returned 0x1f1b560 [0077.828] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x24) returned 0x1f17fc0 [0077.828] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x98) returned 0x1f18ba8 [0077.828] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x34) returned 0x1f17b90 [0077.828] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x154) returned 0x1f18c48 [0077.828] lstrcmpiA (lpString1="MSComctlLib.StatusBar", lpString2="VB.Image") returned -1 [0077.828] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x15) returned 0x1f13b18 [0077.829] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x114) returned 0x1f196d8 [0077.829] lstrlenA (lpString="VB") returned 2 [0077.829] lstrlenA (lpString="Data") returned 4 [0077.829] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x8) returned 0x1f140a8 [0077.829] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0xd8) returned 0x1f18da8 [0077.829] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x3c) returned 0x1f18e88 [0077.829] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x1d8) returned 0x1f1c000 [0077.829] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x15) returned 0x1f13978 [0077.829] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x114) returned 0x1f19ca0 [0077.829] lstrlenA (lpString="VB") returned 2 [0077.829] lstrlenA (lpString="OLE") returned 3 [0077.829] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x7) returned 0x28b5be8 [0077.829] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x17c) returned 0x1f1c1e0 [0077.829] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x40) returned 0x1f18ed0 [0077.830] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x2f0) returned 0x1f1c368 [0077.830] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x15) returned 0x1f137b8 [0077.831] IMalloc:Alloc (This=0x75638d00, cb=0x64) returned 0x716d78 [0077.831] IMalloc:Alloc (This=0x75638d00, cb=0x64) returned 0x716de8 [0077.832] IMalloc:Alloc (This=0x75638d00, cb=0x64) returned 0x716e58 [0077.832] IMalloc:Alloc (This=0x75638d00, cb=0x64) returned 0x716ec8 [0077.832] IMalloc:Alloc (This=0x75638d00, cb=0x64) returned 0x716f38 [0077.832] IMalloc:Alloc (This=0x75638d00, cb=0x64) returned 0x716fa8 [0077.832] IMalloc:Alloc (This=0x75638d00, cb=0x64) returned 0x717018 [0077.832] IMalloc:Alloc (This=0x75638d00, cb=0x64) returned 0x717088 [0077.832] IMalloc:Alloc (This=0x75638d00, cb=0x64) returned 0x7170f8 [0077.832] IMalloc:Alloc (This=0x75638d00, cb=0x64) returned 0x717168 [0077.832] IMalloc:Alloc (This=0x75638d00, cb=0x64) returned 0x7171d8 [0077.832] IMalloc:Alloc (This=0x75638d00, cb=0x64) returned 0x717248 [0077.832] IMalloc:Alloc (This=0x75638d00, cb=0x64) returned 0x717740 [0077.832] IMalloc:Alloc (This=0x75638d00, cb=0x64) returned 0x717580 [0077.832] IMalloc:Alloc (This=0x75638d00, cb=0x64) returned 0x717a50 [0077.832] IMalloc:Alloc (This=0x75638d00, cb=0x64) returned 0x7176d0 [0077.832] IMalloc:Alloc (This=0x75638d00, cb=0x64) returned 0x717510 [0077.832] IMalloc:Alloc (This=0x75638d00, cb=0x64) returned 0x717970 [0077.833] IMalloc:Alloc (This=0x75638d00, cb=0x64) returned 0x717900 [0077.833] IMalloc:Alloc (This=0x75638d00, cb=0x64) returned 0x717350 [0077.833] IMalloc:Alloc (This=0x75638d00, cb=0x64) returned 0x7179e0 [0077.833] IMalloc:Alloc (This=0x75638d00, cb=0x64) returned 0x7173c0 [0077.833] IMalloc:Alloc (This=0x75638d00, cb=0x64) returned 0x7175f0 [0077.833] IMalloc:Alloc (This=0x75638d00, cb=0x64) returned 0x7172e0 [0077.833] IMalloc:Alloc (This=0x75638d00, cb=0x64) returned 0x717660 [0077.833] IMalloc:Alloc (This=0x75638d00, cb=0x64) returned 0x7177b0 [0077.833] IMalloc:Alloc (This=0x75638d00, cb=0x64) returned 0x717820 [0077.833] IMalloc:Alloc (This=0x75638d00, cb=0xc) returned 0x70e918 [0077.833] IMalloc:Alloc (This=0x75638d00, cb=0x234) returned 0x717ac0 [0077.833] IMalloc:GetSize (This=0x75638d00, pv=0x717ac0) returned 0x234 [0077.834] IMalloc:Alloc (This=0x75638d00, cb=0x20) returned 0x6fab38 [0077.836] GetCurrentThreadId () returned 0xa7c [0077.894] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x54) returned 0x1f18f18 [0077.894] GetCurrentThreadId () returned 0xa7c [0077.895] IMalloc:Alloc (This=0x75638d00, cb=0x1c) returned 0x6faa70 [0077.895] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x104) returned 0x1f1c660 [0077.895] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x6f8) returned 0x1f1c770 [0077.895] VirtualProtect (in: lpAddress=0x4b0000, dwSize=0x6000, flNewProtect=0x4, lpflOldProtect=0x19fdf0 | out: lpflOldProtect=0x19fdf0*=0x20) returned 1 [0077.895] GetCurrentProcess () returned 0xffffffff [0077.895] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x4b0000, dwSize=0x6000) returned 1 [0077.896] VirtualAlloc (lpAddress=0x4b0000, dwSize=0x7000, flAllocationType=0x1000, flProtect=0x4) returned 0x4b0000 [0077.896] VirtualAlloc (lpAddress=0x4b0000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x4b0000 [0077.896] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0xd4) returned 0x1f1ce70 [0077.896] VirtualAlloc (lpAddress=0x4b0000, dwSize=0x9000, flAllocationType=0x1000, flProtect=0x4) returned 0x4b0000 [0077.897] VirtualAlloc (lpAddress=0x4b0000, dwSize=0xa000, flAllocationType=0x1000, flProtect=0x4) returned 0x4b0000 [0077.897] VirtualProtect (in: lpAddress=0x4b0000, dwSize=0xa000, flNewProtect=0x20, lpflOldProtect=0x19fdf0 | out: lpflOldProtect=0x19fdf0*=0x4) returned 1 [0077.899] GetCurrentProcess () returned 0xffffffff [0077.899] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x4b0000, dwSize=0xa000) returned 1 [0077.900] GetCurrentThreadId () returned 0xa7c [0077.900] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x23ec) returned 0x1f1cf50 [0077.915] GetCurrentThreadId () returned 0xa7c [0077.915] SetWindowTextA (hWnd=0x602d2, lpString="ExtendedRTFDemo") returned 1 [0077.915] NtdllDefWindowProc_A (hWnd=0x602d2, Msg=0xc, wParam=0x0, lParam=0x19fd64) returned 0x1 [0077.916] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\VBA\\Monitors", phkResult=0x19fd4c | out: phkResult=0x19fd4c*=0x0) returned 0x2 [0077.917] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0077.918] VirtualQuery (in: lpAddress=0x19f778, lpBuffer=0x19f75c, dwLength=0x1c | out: lpBuffer=0x19f75c*(BaseAddress=0x19f000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0077.920] IMalloc:Alloc (This=0x75638d00, cb=0x48) returned 0x718360 [0077.920] IMalloc:GetSize (This=0x75638d00, pv=0x718360) returned 0x48 [0077.922] GetCurrentThreadId () returned 0xa7c [0077.922] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x104) returned 0x1f1f348 [0077.922] GetCurrentThreadId () returned 0xa7c [0077.922] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x7c) returned 0x1f1f458 [0077.922] GetCurrentThreadId () returned 0xa7c [0077.925] GetCurrentThreadId () returned 0xa7c [0077.925] GetCurrentThreadId () returned 0xa7c [0077.925] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x140) returned 0x1f14b58 [0077.925] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x10) returned 0x1f1b848 [0077.926] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x434) returned 0x1f1f4e0 [0077.926] CreateEventA (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x130 [0077.928] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x1a8) returned 0x1f1f920 [0077.928] GetVersionExA (in: lpVersionInformation=0x19fa64*(dwOSVersionInfoSize=0x94, dwMajorVersion=0xa3, dwMinorVersion=0x926588, dwBuildNumber=0xa, dwPlatformId=0x1f1f920, szCSDVersion="\x18ùñ\x01¨v\x8b\x02£") | out: lpVersionInformation=0x19fa64*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0077.929] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0077.929] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x15) returned 0x1f13958 [0077.929] lstrlenA (lpString="MDIForm1") returned 8 [0077.929] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x9) returned 0x1f1b830 [0077.929] OleTranslateColor () returned 0x0 [0077.932] OleLoadPictureEx () returned 0x0 [0078.200] CPicture::get_Type () returned 0x0 [0078.200] CPicture::QueryInterface () returned 0x0 [0078.202] CPicture::AddRef () returned 0x3 [0078.202] CPicture::Release () returned 0x2 [0078.202] CPicture::Release () returned 0x1 [0078.202] LoadIconA (hInstance=0x66000000, lpIconName=0x4b1) returned 0x120375 [0078.205] OleCreatePictureIndirect () returned 0x0 [0078.205] CPicture::AddRef () returned 0x2 [0078.206] CPicture::QueryInterface () returned 0x0 [0078.206] CPicture::get_Type () returned 0x0 [0078.206] CPicture::get_Type () returned 0x0 [0078.206] CPicture::AddRef () returned 0x4 [0078.206] CPicture::Release () returned 0x3 [0078.206] CPicture::Release () returned 0x2 [0078.206] lstrlenA (lpString="MDIForm1") returned 8 [0078.206] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x9) returned 0x1f1b818 [0078.206] lstrlenA (lpString="ThunderRT6") returned 10 [0078.206] lstrcpyA (in: lpString1=0x19fab0, lpString2="ThunderRT6" | out: lpString1="ThunderRT6") returned="ThunderRT6" [0078.206] lstrlenA (lpString="ThunderRT6") returned 10 [0078.206] lstrcpyA (in: lpString1=0x19fa44, lpString2="ThunderRT6" | out: lpString1="ThunderRT6") returned="ThunderRT6" [0078.206] GetClassInfoA (in: hInstance=0x66000000, lpClassName="ThunderRT6MDIForm", lpWndClass=0x19fa70 | out: lpWndClass=0x19fa70) returned 0 [0078.206] LoadCursorA (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0078.206] RegisterClassA (lpWndClass=0x19fa70) returned 0xc1c5 [0078.207] AdjustWindowRectEx (in: lpRect=0x19fb70, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x40000 | out: lpRect=0x19fb70) returned 1 [0078.207] CreateWindowExA (dwExStyle=0x40000, lpClassName=0xc1c5, lpWindowName="MDIForm1", dwStyle=0x2cf0000, X=-2147483648, Y=-2147483648, nWidth=273, nHeight=187, hWndParent=0x602d2, hMenu=0x0, hInstance=0x66000000, lpParam=0x0) returned 0x501f6 [0078.210] DefFrameProcA (hWnd=0x501f6, hWndMDIClient=0x0, uMsg=0x81, wParam=0x0, lParam=0x19f620) returned 0x1 [0078.211] DefFrameProcA (hWnd=0x501f6, hWndMDIClient=0x0, uMsg=0x83, wParam=0x0, lParam=0x19f60c) returned 0x0 [0078.604] GetSystemMenu (hWnd=0x501f6, bRevert=0) returned 0xa01a7 [0078.624] CreateMenu () returned 0x60267 [0078.624] GetClientRect (in: hWnd=0x501f6, lpRect=0x19f390 | out: lpRect=0x19f390) returned 1 [0078.624] CreateWindowExA (dwExStyle=0x200, lpClassName="mdiclient", lpWindowName=0x0, dwStyle=0x46300001, X=0, Y=0, nWidth=257, nHeight=148, hWndParent=0x501f6, hMenu=0xcac, hInstance=0x66000000, lpParam=0x19f3a0) returned 0x402d8 [0078.630] IsWindow (hWnd=0x402d8) returned 1 [0078.630] SendMessageA (hWnd=0x402d8, Msg=0x2210, wParam=0xcac0001, lParam=0x402d8) returned 0x0 [0078.631] GetWindowLongA (hWnd=0x402d8, nIndex=-4) returned 1954221696 [0078.631] SetWindowLongA (hWnd=0x402d8, nIndex=-4, dwNewLong=1711814061) returned 2006429680 [0078.631] ShowWindow (hWnd=0x402d8, nCmdShow=5) returned 0 [0078.631] GetParent (hWnd=0x402d8) returned 0x501f6 [0078.631] CallWindowProcA (lpPrevWndFunc=0x747b0e80, hWnd=0x402d8, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0078.632] GetWindowLongA (hWnd=0x501f6, nIndex=-16) returned 114229248 [0078.632] GetClientRect (in: hWnd=0x501f6, lpRect=0x19f228 | out: lpRect=0x19f228) returned 1 [0078.632] MapWindowPoints (in: hWndFrom=0x501f6, hWndTo=0x0, lpPoints=0x19f228, cPoints=0x2 | out: lpPoints=0x19f228) returned 12255396 [0078.632] CreateMenu () returned 0x690369 [0078.633] GetClientRect (in: hWnd=0x501f6, lpRect=0x19f1f0 | out: lpRect=0x19f1f0) returned 1 [0078.633] MapWindowPoints (in: hWndFrom=0x501f6, hWndTo=0x0, lpPoints=0x19f1f0, cPoints=0x2 | out: lpPoints=0x19f1f0) returned 12255396 [0078.633] EqualRect (lprc1=0x19f1f0, lprc2=0x19f228) returned 1 [0078.633] SetWindowContextHelpId (param_1=0x501f6, param_2=0xffffffff) returned 1 [0078.633] DefFrameProcA (hWnd=0x501f6, hWndMDIClient=0x402d8, uMsg=0x1, wParam=0x0, lParam=0x19f620) returned 0x0 [0078.633] GetParent (hWnd=0x402d8) returned 0x501f6 [0078.633] CallWindowProcA (lpPrevWndFunc=0x747b0e80, hWnd=0x402d8, Msg=0x229, wParam=0x0, lParam=0x19f3cc) returned 0x0 [0078.634] GetWindowRect (in: hWnd=0x501f6, lpRect=0x19fb34 | out: lpRect=0x19fb34) returned 1 [0078.636] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0xdc) returned 0x1f1fad0 [0078.636] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x15) returned 0x1f137d8 [0078.637] lstrlenA (lpString="ThunderRT6") returned 10 [0078.637] lstrcpyA (in: lpString1=0x19fa80, lpString2="ThunderRT6" | out: lpString1="ThunderRT6") returned="ThunderRT6" [0078.637] lstrlenA (lpString="ThunderRT6") returned 10 [0078.637] lstrcpyA (in: lpString1=0x19fa14, lpString2="ThunderRT6" | out: lpString1="ThunderRT6") returned="ThunderRT6" [0078.637] GetClassInfoA (in: hInstance=0x66000000, lpClassName="ThunderRT6Timer", lpWndClass=0x19fa40 | out: lpWndClass=0x19fa40) returned 0 [0078.638] LoadCursorA (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0078.647] RegisterClassA (lpWndClass=0x19fa40) returned 0xc1dd [0078.647] CreateWindowExA (dwExStyle=0x4, lpClassName=0xc1dd, lpWindowName=0x0, dwStyle=0x44010000, X=136, Y=80, nWidth=0, nHeight=0, hWndParent=0x501f6, hMenu=0x1, hInstance=0x66000000, lpParam=0x0) returned 0x2036e [0078.647] NtdllDefWindowProc_A (hWnd=0x2036e, Msg=0x81, wParam=0x0, lParam=0x19f5f0) returned 0x1 [0078.648] NtdllDefWindowProc_A (hWnd=0x2036e, Msg=0x83, wParam=0x0, lParam=0x19f5dc) returned 0x0 [0078.648] NtdllDefWindowProc_A (hWnd=0x2036e, Msg=0x1, wParam=0x0, lParam=0x19f5f0) returned 0x0 [0078.648] NtdllDefWindowProc_A (hWnd=0x2036e, Msg=0x5, wParam=0x0, lParam=0x0) returned 0x0 [0078.648] NtdllDefWindowProc_A (hWnd=0x2036e, Msg=0x3, wParam=0x0, lParam=0x500088) returned 0x0 [0078.649] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0xdc) returned 0x1f1fbb8 [0078.649] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x15) returned 0x1f13818 [0078.649] lstrlenA (lpString="ThunderRT6") returned 10 [0078.649] lstrcpyA (in: lpString1=0x19fa80, lpString2="ThunderRT6" | out: lpString1="ThunderRT6") returned="ThunderRT6" [0078.649] CreateWindowExA (dwExStyle=0x4, lpClassName=0xc1dd, lpWindowName=0x0, dwStyle=0x44010000, X=40, Y=40, nWidth=0, nHeight=0, hWndParent=0x501f6, hMenu=0x2, hInstance=0x66000000, lpParam=0x0) returned 0x501ec [0078.650] NtdllDefWindowProc_A (hWnd=0x501ec, Msg=0x81, wParam=0x0, lParam=0x19f5f0) returned 0x1 [0078.651] NtdllDefWindowProc_A (hWnd=0x501ec, Msg=0x83, wParam=0x0, lParam=0x19f5dc) returned 0x0 [0078.651] NtdllDefWindowProc_A (hWnd=0x501ec, Msg=0x1, wParam=0x0, lParam=0x19f5f0) returned 0x0 [0078.652] NtdllDefWindowProc_A (hWnd=0x501ec, Msg=0x5, wParam=0x0, lParam=0x0) returned 0x0 [0078.652] NtdllDefWindowProc_A (hWnd=0x501ec, Msg=0x3, wParam=0x0, lParam=0x280028) returned 0x0 [0078.652] GetClientRect (in: hWnd=0x501f6, lpRect=0x19fbf0 | out: lpRect=0x19fbf0) returned 1 [0078.652] MapWindowPoints (in: hWndFrom=0x501f6, hWndTo=0x0, lpPoints=0x19fbf0, cPoints=0x2 | out: lpPoints=0x19fbf0) returned 12255396 [0078.652] EqualRect (lprc1=0x19fbf0, lprc2=0x19fbd0) returned 1 [0078.652] SetEvent (hEvent=0x130) returned 1 [0078.652] CPicture::get_Attributes () returned 0x0 [0078.652] SendMessageA (hWnd=0x402d8, Msg=0x230, wParam=0x690369, lParam=0x0) returned 0x0 [0078.652] GetParent (hWnd=0x402d8) returned 0x501f6 [0078.652] CallWindowProcA (lpPrevWndFunc=0x747b0e80, hWnd=0x402d8, Msg=0x230, wParam=0x690369, lParam=0x0) returned 0x0 [0078.653] SendMessageA (hWnd=0x402d8, Msg=0x230, wParam=0x690369, lParam=0x60267) returned 0x690369 [0078.653] GetParent (hWnd=0x402d8) returned 0x501f6 [0078.653] CallWindowProcA (lpPrevWndFunc=0x747b0e80, hWnd=0x402d8, Msg=0x230, wParam=0x690369, lParam=0x60267) returned 0x690369 [0078.653] DrawMenuBar (hWnd=0x501f6) returned 1 [0078.653] DefFrameProcA (hWnd=0x501f6, hWndMDIClient=0x402d8, uMsg=0x46, wParam=0x0, lParam=0x19fa24) returned 0x0 [0078.653] DefFrameProcA (hWnd=0x501f6, hWndMDIClient=0x402d8, uMsg=0x83, wParam=0x1, lParam=0x19f9fc) returned 0x0 [0078.657] GetParent (hWnd=0x501f6) returned 0x0 [0078.657] GetWindowRect (in: hWnd=0x501f6, lpRect=0x19f5dc | out: lpRect=0x19f5dc) returned 1 [0078.657] DefFrameProcA (hWnd=0x501f6, hWndMDIClient=0x402d8, uMsg=0x47, wParam=0x0, lParam=0x19fa24) returned 0x0 [0078.657] GetWindowLongA (hWnd=0x501f6, nIndex=-16) returned 114229248 [0078.657] GetClientRect (in: hWnd=0x501f6, lpRect=0x19f64c | out: lpRect=0x19f64c) returned 1 [0078.657] MapWindowPoints (in: hWndFrom=0x501f6, hWndTo=0x0, lpPoints=0x19f64c, cPoints=0x2 | out: lpPoints=0x19f64c) returned 12255396 [0079.084] DefFrameProcA (hWnd=0x501f6, hWndMDIClient=0x402d8, uMsg=0x7f, wParam=0x2, lParam=0x0) returned 0x0 [0079.084] DefFrameProcA (hWnd=0x501f6, hWndMDIClient=0x402d8, uMsg=0x7f, wParam=0x0, lParam=0x0) returned 0x0 [0079.085] DefFrameProcA (hWnd=0x501f6, hWndMDIClient=0x402d8, uMsg=0x7f, wParam=0x1, lParam=0x0) returned 0x0 [0079.086] CPicture::get_hPal () returned 0x0 [0079.086] CPicture::AddRef () returned 0x2 [0079.086] CPicture::get_Type () returned 0x0 [0079.086] CPicture::get_CurDC () returned 0x0 [0079.086] CPicture::AddRef () returned 0x3 [0079.086] CPicture::Release () returned 0x2 [0079.086] CPicture::get_Type () returned 0x0 [0079.086] CPicture::QueryInterface () returned 0x0 [0079.086] CPicture::FindConnectionPoint () returned 0x0 [0079.086] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x10) returned 0x1f1b788 [0079.086] CNotifyCP::Advise () returned 0x0 [0079.086] Release () returned 0x2 [0079.086] InvalidateRect (hWnd=0x501f6, lpRect=0x0, bErase=1) returned 1 [0079.086] UpdateWindow (hWnd=0x501f6) returned 1 [0079.087] CPicture::Release () returned 0x1 [0079.087] CPicture::get_Type () returned 0x0 [0079.087] LoadIconA (hInstance=0x66000000, lpIconName=0x4b2) returned 0x150295 [0079.091] OleCreatePictureIndirect () returned 0x0 [0079.091] CPicture::AddRef () returned 0x2 [0079.091] CPicture::get_Type () returned 0x0 [0079.091] CPicture::AddRef () returned 0x3 [0079.091] CPicture::Release () returned 0x1 [0079.091] IsIconic (hWnd=0x501f6) returned 0 [0079.091] CPicture::get_Handle () returned 0x0 [0079.091] SendMessageA (hWnd=0x501f6, Msg=0x80, wParam=0x1, lParam=0x150295) returned 0x0 [0079.092] DefFrameProcA (hWnd=0x501f6, hWndMDIClient=0x402d8, uMsg=0x80, wParam=0x1, lParam=0x150295) returned 0x0 [0079.094] CPicture::Release () returned 0x2 [0079.095] IsIconic (hWnd=0x501f6) returned 0 [0079.095] IsZoomed (hWnd=0x501f6) returned 0 [0079.095] GetClientRect (in: hWnd=0x501f6, lpRect=0x19fbe4 | out: lpRect=0x19fbe4) returned 1 [0079.095] GetWindow (hWnd=0x501f6, uCmd=0x5) returned 0x402d8 [0079.095] GetWindow (hWnd=0x402d8, uCmd=0x2) returned 0x2036e [0079.095] GetWindow (hWnd=0x2036e, uCmd=0x2) returned 0x501ec [0079.095] GetParent (hWnd=0x2036e) returned 0x501f6 [0079.095] GetWindow (hWnd=0x501ec, uCmd=0x2) returned 0x0 [0079.095] GetParent (hWnd=0x501ec) returned 0x501f6 [0079.095] GetParent (hWnd=0x501ec) returned 0x501f6 [0079.095] MoveWindow (hWnd=0x402d8, X=0, Y=0, nWidth=257, nHeight=148, bRepaint=1) returned 1 [0079.095] GetParent (hWnd=0x402d8) returned 0x501f6 [0079.095] CallWindowProcA (lpPrevWndFunc=0x747b0e80, hWnd=0x402d8, Msg=0x46, wParam=0x0, lParam=0x19fb7c) returned 0x0 [0079.097] IsWindowVisible (hWnd=0x501f6) returned 0 [0079.097] ShowWindow (hWnd=0x501f6, nCmdShow=0) returned 0 [0079.097] GetWindowLongA (hWnd=0x501f6, nIndex=-20) returned 262400 [0079.097] SetWindowLongA (hWnd=0x501f6, nIndex=-20, dwNewLong=262400) returned 262400 [0079.097] DefFrameProcA (hWnd=0x501f6, hWndMDIClient=0x402d8, uMsg=0x7c, wParam=0xffffffec, lParam=0x19f75c) returned 0x0 [0079.098] DefFrameProcA (hWnd=0x501f6, hWndMDIClient=0x402d8, uMsg=0x7d, wParam=0xffffffec, lParam=0x19f75c) returned 0x0 [0079.098] DefFrameProcA (hWnd=0x501f6, hWndMDIClient=0x402d8, uMsg=0x7f, wParam=0x2, lParam=0x0) returned 0xb0385 [0079.102] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0xfc) returned 0x1f1fca0 [0079.102] GetCurrentThreadId () returned 0xa7c [0079.102] GetCurrentThreadId () returned 0xa7c [0079.102] GetCurrentThreadId () returned 0xa7c [0079.102] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x10) returned 0x1f1b6f8 [0079.102] SetWindowTextA (hWnd=0x602d2, lpString="ExtendedRTFDemo") returned 1 [0079.102] NtdllDefWindowProc_A (hWnd=0x602d2, Msg=0xc, wParam=0x0, lParam=0x1f1b6f8) returned 0x1 [0079.102] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x1) returned 0x28bd130 [0079.103] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x10) returned 0x1f1b7a0 [0079.103] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x10) returned 0x1f1b6b0 [0079.103] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x15) returned 0x1f13838 [0079.103] GetModuleFileNameA (in: hModule=0x400000, lpFilename=0x19f6dc, nSize=0x104 | out: lpFilename="C:\\Users\\RDhJ0CNFevzX\\Desktop\\de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797.exe")) returned 0x62 [0079.103] lstrcpynA (in: lpString1=0x19f5c8, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797.exe", iMaxLength=260 | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797.exe") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797.exe" [0079.103] lstrlenA (lpString="C:\\Users\\RDhJ0CNFevzX\\Desktop\\de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797.exe") returned 98 [0079.103] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x63) returned 0x1f1fda8 [0079.103] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x63) returned 0x1f1fe18 [0079.103] lstrcpyA (in: lpString1=0x1f1fda8, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797.exe" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797.exe") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797.exe" [0079.109] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x41) returned 0x1f1fe88 [0079.109] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f1fe18 | out: hHeap=0x28b0000) returned 1 [0079.109] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f1fda8 | out: hHeap=0x28b0000) returned 1 [0079.109] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1f1fe88, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 65 [0079.109] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1f1fe88, cbMultiByte=-1, lpWideCharStr=0x71973c, cchWideChar=65 | out: lpWideCharStr="de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797") returned 65 [0079.109] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f1fe88 | out: hHeap=0x28b0000) returned 1 [0079.109] GetModuleFileNameA (in: hModule=0x400000, lpFilename=0x19f6dc, nSize=0x104 | out: lpFilename="C:\\Users\\RDhJ0CNFevzX\\Desktop\\de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797.exe")) returned 0x62 [0079.110] lstrcpynA (in: lpString1=0x19f5c8, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797.exe", iMaxLength=260 | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797.exe") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797.exe" [0079.110] lstrlenA (lpString="C:\\Users\\RDhJ0CNFevzX\\Desktop\\de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797.exe") returned 98 [0079.110] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x63) returned 0x1f1fda8 [0079.111] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x63) returned 0x1f1fe18 [0079.111] lstrcpyA (in: lpString1=0x1f1fda8, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797.exe" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797.exe") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797.exe" [0079.113] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x1e) returned 0x1f16d10 [0079.113] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f1fe18 | out: hHeap=0x28b0000) returned 1 [0079.113] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f1fda8 | out: hHeap=0x28b0000) returned 1 [0079.113] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1f16d10, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 30 [0079.113] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1f16d10, cbMultiByte=-1, lpWideCharStr=0x715e4c, cchWideChar=30 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 30 [0079.113] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f16d10 | out: hHeap=0x28b0000) returned 1 [0079.114] GetUserDefaultLCID () returned 0x409 [0079.115] GetLocaleInfoA (in: Locale=0x409, LCType=0x1004, lpLCData=0x19f700, cchData=6 | out: lpLCData="1252") returned 5 [0079.115] SysStringLen (param_1="xrkxjpwnv") returned 0x9 [0079.115] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="xrkxjpwnv", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0079.115] SysStringLen (param_1="xrkxjpwnv") returned 0x9 [0079.115] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="xrkxjpwnv", cchWideChar=10, lpMultiByteStr=0x70e904, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xrkxjpwnv", lpUsedDefaultChar=0x0) returned 10 [0079.115] SafeArrayAllocDescriptorEx (in: vt=0x11, cDims=0x1, ppsaOut=0x19f710 | out: ppsaOut=0x19f710) returned 0x0 [0079.115] GetUserDefaultLCID () returned 0x409 [0079.115] GetLocaleInfoA (in: Locale=0x409, LCType=0x1004, lpLCData=0x19f700, cchData=6 | out: lpLCData="1252") returned 5 [0079.115] SysStringLen (param_1="“") returned 0x1 [0079.115] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="“", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0079.116] SysStringLen (param_1="“") returned 0x1 [0079.116] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="“", cchWideChar=2, lpMultiByteStr=0x70e904, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x93", lpUsedDefaultChar=0x0) returned 2 [0079.116] SafeArrayAllocDescriptorEx (in: vt=0x11, cDims=0x1, ppsaOut=0x19f710 | out: ppsaOut=0x19f710) returned 0x0 [0079.116] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x4106e0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0079.116] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x4106e0, cbMultiByte=-1, lpWideCharStr=0x6faca4, cchWideChar=11 | out: lpWideCharStr="ExtendeRTF") returned 11 [0079.117] RaiseException (dwExceptionCode=0xc000008f, dwExceptionFlags=0x1, nNumberOfArguments=0x2, lpArguments=0x19f6f4) [0079.118] RtlUnwind (TargetFrame=0x19f84c, TargetIp=0x66103caf, ExceptionRecord=0x0, ReturnValue=0x0) [0079.118] GetUserDefaultLCID () returned 0x409 [0079.120] GetLocaleInfoA (in: Locale=0x409, LCType=0x1004, lpLCData=0x19f700, cchData=6 | out: lpLCData="1252") returned 5 [0079.120] SysStringByteLen (bstr="\\") returned 0x1 [0079.120] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x70e904, cbMultiByte=1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0079.120] SysStringByteLen (bstr="\\") returned 0x1 [0079.120] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x70e904, cbMultiByte=2, lpWideCharStr=0x70ea84, cchWideChar=3 | out: lpWideCharStr="\\") returned 2 [0079.121] SafeArrayDestroyDescriptor (psa=0x7194b8) returned 0x0 [0079.121] SafeArrayDestroyDescriptor (psa=0x719488) returned 0x0 [0079.121] GetUserDefaultLCID () returned 0x409 [0079.121] GetLocaleInfoA (in: Locale=0x409, LCType=0x1004, lpLCData=0x19f700, cchData=6 | out: lpLCData="1252") returned 5 [0079.121] SysStringLen (param_1="xrkxjpwnv") returned 0x9 [0079.121] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="xrkxjpwnv", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0079.121] SysStringLen (param_1="xrkxjpwnv") returned 0x9 [0079.121] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="xrkxjpwnv", cchWideChar=10, lpMultiByteStr=0x70e994, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xrkxjpwnv", lpUsedDefaultChar=0x0) returned 10 [0079.121] SafeArrayAllocDescriptorEx (in: vt=0x11, cDims=0x1, ppsaOut=0x19f710 | out: ppsaOut=0x19f710) returned 0x0 [0079.121] GetUserDefaultLCID () returned 0x409 [0079.121] GetLocaleInfoA (in: Locale=0x409, LCType=0x1004, lpLCData=0x19f700, cchData=6 | out: lpLCData="1252") returned 5 [0079.121] SysStringLen (param_1="áí¤\x1f") returned 0x4 [0079.121] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="áí¤\x1f", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0079.122] SysStringLen (param_1="áí¤\x1f") returned 0x4 [0079.122] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="áí¤\x1f", cchWideChar=5, lpMultiByteStr=0x70e994, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="áí¤\x1f", lpUsedDefaultChar=0x0) returned 5 [0079.122] SafeArrayAllocDescriptorEx (in: vt=0x11, cDims=0x1, ppsaOut=0x19f710 | out: ppsaOut=0x19f710) returned 0x0 [0079.122] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x4106e0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0079.122] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x4106e0, cbMultiByte=-1, lpWideCharStr=0x6faa9c, cchWideChar=11 | out: lpWideCharStr="ExtendeRTF") returned 11 [0079.122] RaiseException (dwExceptionCode=0xc000008f, dwExceptionFlags=0x1, nNumberOfArguments=0x2, lpArguments=0x19f6f4) [0079.122] RtlUnwind (TargetFrame=0x19f84c, TargetIp=0x66103caf, ExceptionRecord=0x0, ReturnValue=0x0) [0079.122] GetUserDefaultLCID () returned 0x409 [0079.122] GetLocaleInfoA (in: Locale=0x409, LCType=0x1004, lpLCData=0x19f700, cchData=6 | out: lpLCData="1252") returned 5 [0079.122] SysStringByteLen (bstr="攮數") returned 0x4 [0079.122] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x70e994, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0079.122] SysStringByteLen (bstr="攮數") returned 0x4 [0079.122] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x70e994, cbMultiByte=5, lpWideCharStr=0x70e9ac, cchWideChar=9 | out: lpWideCharStr=".exe") returned 5 [0079.122] SafeArrayDestroyDescriptor (psa=0x719368) returned 0x0 [0079.123] SafeArrayDestroyDescriptor (psa=0x7195d8) returned 0x0 [0079.123] GetUserDefaultLCID () returned 0x409 [0079.123] VarBstrFromI2 (iVal=1, lcid=0x409, dwFlags=0x0, pbstrOut=0x19f910*="롴q") returned 0x0 [0079.123] GetUserDefaultLCID () returned 0x409 [0079.123] VarI2FromStr (in: strIn="1", lcid=0x409, dwFlags=0x0, psOut=0x19f912 | out: psOut=0x19f912) returned 0x0 [0079.126] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797.exe", cchWideChar=-1, lpMultiByteStr=0x19f6c4, cbMultiByte=261, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797.exe", lpUsedDefaultChar=0x0) returned 99 [0079.126] GetFullPathNameA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797.exe", nBufferLength=0x104, lpBuffer=0x19f7f4, lpFilePart=0x19f6bc | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797.exe", lpFilePart=0x19f6bc*="de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797.exe") returned 0x62 [0079.127] CreateFileA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x19f7b4, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0079.128] GetLastError () returned 0x20 [0079.128] GetLastError () returned 0x20 [0079.128] SetLastError (dwErrCode=0x20) [0079.128] GetLastError () returned 0x20 [0079.128] SetLastError (dwErrCode=0x20) [0079.128] GetLastError () returned 0x20 [0079.128] SetLastError (dwErrCode=0x20) [0079.129] CreateFileA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x19f7b4, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0079.129] GetLastError () returned 0x20 [0079.129] GetLastError () returned 0x20 [0079.129] SetLastError (dwErrCode=0x20) [0079.129] GetLastError () returned 0x20 [0079.129] SetLastError (dwErrCode=0x20) [0079.129] GetLastError () returned 0x20 [0079.129] SetLastError (dwErrCode=0x20) [0079.129] CreateFileA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x19f7b4, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0079.129] GetFileType (hFile=0x160) returned 0x1 [0079.129] IMalloc:Alloc (This=0x75638d00, cb=0x9f) returned 0x701318 [0079.130] IMalloc:Realloc (This=0x75638d00, pv=0x0, cb=0x60) returned 0x71b948 [0079.130] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0079.130] IMalloc:Alloc (This=0x75638d00, cb=0x40) returned 0x715fb0 [0079.130] IMalloc:GetSize (This=0x75638d00, pv=0x715fb0) returned 0x40 [0079.130] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x34) returned 0x1f123c8 [0079.130] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x28) returned 0x1f182f0 [0079.130] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x20) returned 0x1f16d10 [0079.130] GetModuleFileNameA (in: hModule=0x400000, lpFilename=0x19f6dc, nSize=0x104 | out: lpFilename="C:\\Users\\RDhJ0CNFevzX\\Desktop\\de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797.exe")) returned 0x62 [0079.130] lstrcpynA (in: lpString1=0x19f5c8, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797.exe", iMaxLength=260 | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797.exe") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797.exe" [0079.130] lstrlenA (lpString="C:\\Users\\RDhJ0CNFevzX\\Desktop\\de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797.exe") returned 98 [0079.130] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x63) returned 0x1f1fda8 [0079.130] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x63) returned 0x1f1fe18 [0079.131] lstrcpyA (in: lpString1=0x1f1fda8, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797.exe" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797.exe") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797.exe" [0079.131] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x41) returned 0x1f1fe88 [0079.131] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f1fe18 | out: hHeap=0x28b0000) returned 1 [0079.131] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f1fda8 | out: hHeap=0x28b0000) returned 1 [0079.131] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1f1fe88, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 65 [0079.131] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1f1fe88, cbMultiByte=-1, lpWideCharStr=0x71b7dc, cchWideChar=65 | out: lpWideCharStr="de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797") returned 65 [0079.131] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f1fe88 | out: hHeap=0x28b0000) returned 1 [0079.131] GetModuleFileNameA (in: hModule=0x400000, lpFilename=0x19f6dc, nSize=0x104 | out: lpFilename="C:\\Users\\RDhJ0CNFevzX\\Desktop\\de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797.exe")) returned 0x62 [0079.131] lstrcpynA (in: lpString1=0x19f5c8, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797.exe", iMaxLength=260 | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797.exe") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797.exe" [0079.131] lstrlenA (lpString="C:\\Users\\RDhJ0CNFevzX\\Desktop\\de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797.exe") returned 98 [0079.131] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x63) returned 0x1f1fda8 [0079.131] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x63) returned 0x1f1fe18 [0079.131] lstrcpyA (in: lpString1=0x1f1fda8, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797.exe" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797.exe") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797.exe" [0079.131] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x1e) returned 0x1f1fe88 [0079.131] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f1fe18 | out: hHeap=0x28b0000) returned 1 [0079.131] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f1fda8 | out: hHeap=0x28b0000) returned 1 [0079.131] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1f1fe88, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 30 [0079.131] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1f1fe88, cbMultiByte=-1, lpWideCharStr=0x715e4c, cchWideChar=30 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 30 [0079.131] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f1fe88 | out: hHeap=0x28b0000) returned 1 [0079.132] GetUserDefaultLCID () returned 0x409 [0079.132] GetLocaleInfoA (in: Locale=0x409, LCType=0x1004, lpLCData=0x19f700, cchData=6 | out: lpLCData="1252") returned 5 [0079.132] SysStringLen (param_1="xrkxjpwnv") returned 0x9 [0079.132] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="xrkxjpwnv", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0079.132] SysStringLen (param_1="xrkxjpwnv") returned 0x9 [0079.132] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="xrkxjpwnv", cchWideChar=10, lpMultiByteStr=0x70e9ac, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xrkxjpwnv", lpUsedDefaultChar=0x0) returned 10 [0079.132] SafeArrayAllocDescriptorEx (in: vt=0x11, cDims=0x1, ppsaOut=0x19f710 | out: ppsaOut=0x19f710) returned 0x0 [0079.132] GetUserDefaultLCID () returned 0x409 [0079.132] GetLocaleInfoA (in: Locale=0x409, LCType=0x1004, lpLCData=0x19f700, cchData=6 | out: lpLCData="1252") returned 5 [0079.132] SysStringLen (param_1="“") returned 0x1 [0079.132] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="“", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0079.132] SysStringLen (param_1="“") returned 0x1 [0079.132] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="“", cchWideChar=2, lpMultiByteStr=0x70e9ac, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x93", lpUsedDefaultChar=0x0) returned 2 [0079.132] SafeArrayAllocDescriptorEx (in: vt=0x11, cDims=0x1, ppsaOut=0x19f710 | out: ppsaOut=0x19f710) returned 0x0 [0079.132] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x4106e0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0079.132] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x4106e0, cbMultiByte=-1, lpWideCharStr=0x6fab64, cchWideChar=11 | out: lpWideCharStr="ExtendeRTF") returned 11 [0079.133] RaiseException (dwExceptionCode=0xc000008f, dwExceptionFlags=0x1, nNumberOfArguments=0x2, lpArguments=0x19f6f4) [0079.133] RtlUnwind (TargetFrame=0x19f84c, TargetIp=0x66103caf, ExceptionRecord=0x0, ReturnValue=0x0) [0079.133] GetUserDefaultLCID () returned 0x409 [0079.133] GetLocaleInfoA (in: Locale=0x409, LCType=0x1004, lpLCData=0x19f700, cchData=6 | out: lpLCData="1252") returned 5 [0079.133] SysStringByteLen (bstr="\\") returned 0x1 [0079.133] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x70e9ac, cbMultiByte=1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0079.133] SysStringByteLen (bstr="\\") returned 0x1 [0079.133] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x70e9ac, cbMultiByte=2, lpWideCharStr=0x70ea6c, cchWideChar=3 | out: lpWideCharStr="\\") returned 2 [0079.133] SafeArrayDestroyDescriptor (psa=0x7196c8) returned 0x0 [0079.133] SafeArrayDestroyDescriptor (psa=0x719668) returned 0x0 [0079.134] GetUserDefaultLCID () returned 0x409 [0079.134] GetLocaleInfoA (in: Locale=0x409, LCType=0x1004, lpLCData=0x19f700, cchData=6 | out: lpLCData="1252") returned 5 [0079.134] SysStringLen (param_1="xrkxjpwnv") returned 0x9 [0079.134] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="xrkxjpwnv", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0079.134] SysStringLen (param_1="xrkxjpwnv") returned 0x9 [0079.134] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="xrkxjpwnv", cchWideChar=10, lpMultiByteStr=0x70e904, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xrkxjpwnv", lpUsedDefaultChar=0x0) returned 10 [0079.134] SafeArrayAllocDescriptorEx (in: vt=0x11, cDims=0x1, ppsaOut=0x19f710 | out: ppsaOut=0x19f710) returned 0x0 [0079.134] GetUserDefaultLCID () returned 0x409 [0079.134] GetLocaleInfoA (in: Locale=0x409, LCType=0x1004, lpLCData=0x19f700, cchData=6 | out: lpLCData="1252") returned 5 [0079.134] SysStringLen (param_1="áí¤\x1f") returned 0x4 [0079.134] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="áí¤\x1f", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0079.134] SysStringLen (param_1="áí¤\x1f") returned 0x4 [0079.134] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="áí¤\x1f", cchWideChar=5, lpMultiByteStr=0x70e904, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="áí¤\x1f", lpUsedDefaultChar=0x0) returned 5 [0079.134] SafeArrayAllocDescriptorEx (in: vt=0x11, cDims=0x1, ppsaOut=0x19f710 | out: ppsaOut=0x19f710) returned 0x0 [0079.134] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x4106e0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0079.135] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x4106e0, cbMultiByte=-1, lpWideCharStr=0x6faa9c, cchWideChar=11 | out: lpWideCharStr="ExtendeRTF") returned 11 [0079.135] RaiseException (dwExceptionCode=0xc000008f, dwExceptionFlags=0x1, nNumberOfArguments=0x2, lpArguments=0x19f6f4) [0079.135] RtlUnwind (TargetFrame=0x19f84c, TargetIp=0x66103caf, ExceptionRecord=0x0, ReturnValue=0x0) [0079.135] GetUserDefaultLCID () returned 0x409 [0079.135] GetLocaleInfoA (in: Locale=0x409, LCType=0x1004, lpLCData=0x19f700, cchData=6 | out: lpLCData="1252") returned 5 [0079.135] SysStringByteLen (bstr="攮數") returned 0x4 [0079.135] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x70e904, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0079.135] SysStringByteLen (bstr="攮數") returned 0x4 [0079.135] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x70e904, cbMultiByte=5, lpWideCharStr=0x70ea84, cchWideChar=9 | out: lpWideCharStr=".exe") returned 5 [0079.135] SafeArrayDestroyDescriptor (psa=0x7196f8) returned 0x0 [0079.135] SafeArrayDestroyDescriptor (psa=0x719398) returned 0x0 [0079.136] SysStringLen (param_1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797.exe") returned 0x62 [0079.136] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797.exe", cchWideChar=98, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 98 [0079.136] SysStringLen (param_1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797.exe") returned 0x62 [0079.136] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797.exe", cchWideChar=99, lpMultiByteStr=0x71973c, cbMultiByte=99, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797.exe", lpUsedDefaultChar=0x0) returned 99 [0079.136] SetErrorMode (uMode=0x8001) returned 0x8001 [0079.136] LoadLibraryA (lpLibFileName="kernel32") returned 0x74650000 [0079.136] SetErrorMode (uMode=0x8001) returned 0x8001 [0079.136] GetProcAddress (hModule=0x74650000, lpProcName="GetCompressedFileSizeA") returned 0x74690cf0 [0079.136] GetCompressedFileSizeA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797.exe"), lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa29a8 [0079.137] GetLastError () returned 0x0 [0079.137] SysStringByteLen (bstr="㩃啜敳獲剜桄お乃敆究屘敄歳潴屰敤挰㕢〰㈱搵㌷戳捥摢扥㌵晣户昳戱捡㑥捤ㄹ㕥㠴㔰〰㜷㠱㜹㄰㐲晥㜶㜹攮數") returned 0x62 [0079.137] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x71973c, cbMultiByte=98, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 98 [0079.137] SysStringByteLen (bstr="㩃啜敳獲剜桄お乃敆究屘敄歳潴屰敤挰㕢〰㈱搵㌷戳捥摢扥㌵晣户昳戱捡㑥捤ㄹ㕥㠴㔰〰㜷㠱㜹㄰㐲晥㜶㜹攮數") returned 0x62 [0079.137] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x71973c, cbMultiByte=99, lpWideCharStr=0x71b874, cchWideChar=197 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797.exe") returned 99 [0079.137] GetUserDefaultLCID () returned 0x409 [0079.137] VarBstrFromI4 (in: lIn=666024, lcid=0x409, dwFlags=0x0, pbstrOut=0x19f860 | out: pbstrOut=0x19f860*="666024") returned 0x0 [0079.169] GetUserDefaultLCID () returned 0x409 [0079.169] VarBstrFromI2 (iVal=1, lcid=0x409, dwFlags=0x0, pbstrOut=0x19f914) returned 0x0 [0079.169] GetUserDefaultLCID () returned 0x409 [0079.169] VarI2FromStr (in: strIn="1", lcid=0x409, dwFlags=0x0, psOut=0x19f916 | out: psOut=0x19f916) returned 0x0 [0079.169] IMalloc:Alloc (This=0x75638d00, cb=0x145350) returned 0x2a47020 [0079.174] ReadFile (in: hFile=0x160, lpBuffer=0x2a47020, nNumberOfBytesToRead=0xa29a8, lpNumberOfBytesRead=0x19f854, lpOverlapped=0x0 | out: lpBuffer=0x2a47020*, lpNumberOfBytesRead=0x19f854*=0xa29a8, lpOverlapped=0x0) returned 1 [0079.185] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2a47020, cbMultiByte=666024, lpWideCharStr=0x28ce024, cchWideChar=666024 | out: lpWideCharStr="MZ\x90") returned 666024 [0079.186] IMalloc:Free (This=0x75638d00, pv=0x2a47020) [0079.191] GetUserDefaultLCID () returned 0x409 [0079.191] VarBstrFromI2 (iVal=1, lcid=0x409, dwFlags=0x0, pbstrOut=0x19f914) returned 0x0 [0079.191] GetUserDefaultLCID () returned 0x409 [0079.191] VarI2FromStr (in: strIn="1", lcid=0x409, dwFlags=0x0, psOut=0x19f916 | out: psOut=0x19f916) returned 0x0 [0079.191] CloseHandle (hObject=0x160) returned 1 [0079.192] IMalloc:Free (This=0x75638d00, pv=0x701318) [0079.192] GetUserDefaultLCID () returned 0x409 [0079.212] SafeArrayCopy (in: psa=0x719518, ppsaOut=0x19f9f4 | out: ppsaOut=0x19f9f4) returned 0x0 [0079.241] GetUserDefaultLCID () returned 0x409 [0079.241] VarR8FromStr (in: strIn="0", lcid=0x409, dwFlags=0x0, pdblOut=0x19f910 | out: pdblOut=0x19f910) returned 0x0 [0079.242] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0079.242] IMalloc:Alloc (This=0x75638d00, cb=0xac) returned 0x7489e0 [0079.242] IMalloc:GetSize (This=0x75638d00, pv=0x7489e0) returned 0xac [0079.242] IMalloc:Alloc (This=0x75638d00, cb=0x2) returned 0x6f6cd0 [0079.242] IMalloc:GetSize (This=0x75638d00, pv=0x6f6cd0) returned 0x2 [0079.242] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x34) returned 0x1f1fda8 [0079.243] GetUserDefaultLCID () returned 0x409 [0079.254] GetLocaleInfoA (in: Locale=0x409, LCType=0x1004, lpLCData=0x19f838, cchData=6 | out: lpLCData="1252") returned 5 [0079.254] SysStringLen (param_1="½’\x9d\x7fo—®™F÷\x0cŠÅ\x0f(¾\x14l£š") returned 0xb400 [0079.254] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="½’\x9d\x7fo—®™F÷\x0cŠÅ\x0f(¾\x14l£š", cchWideChar=46080, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 46080 [0079.255] SysStringLen (param_1="½’\x9d\x7fo—®™F÷\x0cŠÅ\x0f(¾\x14l£š") returned 0xb400 [0079.255] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="½’\x9d\x7fo—®™F÷\x0cŠÅ\x0f(¾\x14l£š", cchWideChar=46081, lpMultiByteStr=0x75f4c4, cbMultiByte=46081, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="½\x92\x9d\x7fo\x97®\x99F÷\x0c\x8aÅ\x0f(¾\x14l£\x9a", lpUsedDefaultChar=0x0) returned 46081 [0079.256] SafeArrayAllocDescriptorEx (in: vt=0x11, cDims=0x1, ppsaOut=0x19f848 | out: ppsaOut=0x19f848) returned 0x0 [0079.258] VarBstrCmp (bstrLeft="EXDXbXKLDXqeXkXIlekXmXBfjdhjXcXGlkbX", bstrRight="", lcid=0x0, dwFlags=0x30001) returned 0x2 [0079.258] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="E", cchWideChar=1, lpMultiByteStr=0x19f7f6, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="E", lpUsedDefaultChar=0x0) returned 1 [0079.258] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="X", cchWideChar=1, lpMultiByteStr=0x19f7f6, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="X", lpUsedDefaultChar=0x0) returned 1 [0079.258] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D", cchWideChar=1, lpMultiByteStr=0x19f7f6, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D", lpUsedDefaultChar=0x0) returned 1 [0079.259] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="X", cchWideChar=1, lpMultiByteStr=0x19f7f6, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="X", lpUsedDefaultChar=0x0) returned 1 [0079.259] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x19f7f6, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b", lpUsedDefaultChar=0x0) returned 1 [0079.259] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="X", cchWideChar=1, lpMultiByteStr=0x19f7f6, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="X", lpUsedDefaultChar=0x0) returned 1 [0079.259] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="K", cchWideChar=1, lpMultiByteStr=0x19f7f6, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="K", lpUsedDefaultChar=0x0) returned 1 [0079.259] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="L", cchWideChar=1, lpMultiByteStr=0x19f7f6, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="L", lpUsedDefaultChar=0x0) returned 1 [0079.259] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D", cchWideChar=1, lpMultiByteStr=0x19f7f6, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D", lpUsedDefaultChar=0x0) returned 1 [0079.259] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="X", cchWideChar=1, lpMultiByteStr=0x19f7f6, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="X", lpUsedDefaultChar=0x0) returned 1 [0079.259] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="q", cchWideChar=1, lpMultiByteStr=0x19f7f6, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="q", lpUsedDefaultChar=0x0) returned 1 [0079.259] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19f7f6, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="e", lpUsedDefaultChar=0x0) returned 1 [0079.260] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="X", cchWideChar=1, lpMultiByteStr=0x19f7f6, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="X", lpUsedDefaultChar=0x0) returned 1 [0079.260] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="k", cchWideChar=1, lpMultiByteStr=0x19f7f6, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="k", lpUsedDefaultChar=0x0) returned 1 [0079.260] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="X", cchWideChar=1, lpMultiByteStr=0x19f7f6, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="X", lpUsedDefaultChar=0x0) returned 1 [0079.260] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="I", cchWideChar=1, lpMultiByteStr=0x19f7f6, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="I", lpUsedDefaultChar=0x0) returned 1 [0079.260] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19f7f6, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="l", lpUsedDefaultChar=0x0) returned 1 [0079.260] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19f7f6, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="e", lpUsedDefaultChar=0x0) returned 1 [0079.260] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="k", cchWideChar=1, lpMultiByteStr=0x19f7f6, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="k", lpUsedDefaultChar=0x0) returned 1 [0079.260] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="X", cchWideChar=1, lpMultiByteStr=0x19f7f6, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="X", lpUsedDefaultChar=0x0) returned 1 [0079.260] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x19f7f6, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="m", lpUsedDefaultChar=0x0) returned 1 [0079.260] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="X", cchWideChar=1, lpMultiByteStr=0x19f7f6, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="X", lpUsedDefaultChar=0x0) returned 1 [0079.260] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="B", cchWideChar=1, lpMultiByteStr=0x19f7f6, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="B", lpUsedDefaultChar=0x0) returned 1 [0079.260] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x19f7f6, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="f", lpUsedDefaultChar=0x0) returned 1 [0079.261] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="j", cchWideChar=1, lpMultiByteStr=0x19f7f6, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="j", lpUsedDefaultChar=0x0) returned 1 [0079.261] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x19f7f6, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="d", lpUsedDefaultChar=0x0) returned 1 [0079.261] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x19f7f6, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="h", lpUsedDefaultChar=0x0) returned 1 [0079.261] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="j", cchWideChar=1, lpMultiByteStr=0x19f7f6, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="j", lpUsedDefaultChar=0x0) returned 1 [0079.261] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="X", cchWideChar=1, lpMultiByteStr=0x19f7f6, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="X", lpUsedDefaultChar=0x0) returned 1 [0079.261] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x19f7f6, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c", lpUsedDefaultChar=0x0) returned 1 [0079.261] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="X", cchWideChar=1, lpMultiByteStr=0x19f7f6, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="X", lpUsedDefaultChar=0x0) returned 1 [0079.261] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="G", cchWideChar=1, lpMultiByteStr=0x19f7f6, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="G", lpUsedDefaultChar=0x0) returned 1 [0079.261] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19f7f6, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="l", lpUsedDefaultChar=0x0) returned 1 [0079.261] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="k", cchWideChar=1, lpMultiByteStr=0x19f7f6, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="k", lpUsedDefaultChar=0x0) returned 1 [0079.261] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x19f7f6, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b", lpUsedDefaultChar=0x0) returned 1 [0079.262] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="X", cchWideChar=1, lpMultiByteStr=0x19f7f6, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="X", lpUsedDefaultChar=0x0) returned 1 [0079.264] GetUserDefaultLCID () returned 0x409 [0079.264] GetLocaleInfoA (in: Locale=0x409, LCType=0x1004, lpLCData=0x19f83c, cchData=6 | out: lpLCData="1252") returned 5 [0079.264] SysStringByteLen (bstr="婍\x90\x03") returned 0xb400 [0079.264] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x75f4cc, cbMultiByte=46080, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 46080 [0079.265] SysStringByteLen (bstr="婍\x90\x03") returned 0xb400 [0079.265] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x75f4cc, cbMultiByte=46081, lpWideCharStr=0x76a8e4, cchWideChar=92161 | out: lpWideCharStr="MZ\x90") returned 46081 [0079.267] SafeArrayDestroyDescriptor (psa=0x719488) returned 0x0 [0079.267] GetUserDefaultLCID () returned 0x409 [0079.269] GetLocaleInfoA (in: Locale=0x409, LCType=0x1004, lpLCData=0x19f8f4, cchData=6 | out: lpLCData="1252") returned 5 [0079.269] SysStringLen (param_1="MZ\x90") returned 0xb400 [0079.269] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZ\x90", cchWideChar=46080, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 46080 [0079.269] SysStringLen (param_1="MZ\x90") returned 0xb400 [0079.269] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZ\x90", cchWideChar=46081, lpMultiByteStr=0x75f4c4, cbMultiByte=46081, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZ\x90", lpUsedDefaultChar=0x0) returned 46081 [0079.270] SafeArrayAllocDescriptorEx (in: vt=0x11, cDims=0x1, ppsaOut=0x19f904 | out: ppsaOut=0x19f904) returned 0x0 [0079.272] GetUserDefaultLCID () returned 0x409 [0079.272] VarR8FromStr (in: strIn="1", lcid=0x409, dwFlags=0x0, pdblOut=0x19f910 | out: pdblOut=0x19f910) returned 0x0 [0079.272] VarBstrCmp (bstrLeft="AppData", bstrRight="AppData", lcid=0x0, dwFlags=0x30001) returned 0x1 [0079.272] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AppData", cchWideChar=8, lpMultiByteStr=0x19f85c, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AppData", lpUsedDefaultChar=0x0) returned 8 [0079.273] CompareStringA (Locale=0x0, dwCmpFlags=0x0, lpString1="", cchCount1=1, lpString2="", cchCount2=1) returned 2 [0079.274] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="APPDATA=C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", cchCount1=7, lpString2="AppData", cchCount2=7) returned 2 [0079.274] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x20202c8, cbMultiByte=38, lpWideCharStr=0x71b874, cchWideChar=76 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 38 [0079.274] SysReAllocStringLen (in: pbstr=0x19f8ec*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", psz=0x0, len=0x25 | out: pbstr=0x19f8ec*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 1 [0079.274] VarCat (in: pvarLeft=0x19f9c8, pvarRight=0x19f974, pvarResult=0x19f9b8 | out: pvarResult=0x19f9b8) returned 0x0 [0079.274] VarCat (in: pvarLeft=0x19f9b8, pvarRight=0x19f964, pvarResult=0x19f9a8 | out: pvarResult=0x19f9a8) returned 0x0 [0079.274] VarCat (in: pvarLeft=0x19f9a8, pvarRight=0x19f954, pvarResult=0x19f998 | out: pvarResult=0x19f998) returned 0x0 [0079.274] CLSIDFromProgIDEx (in: lpszProgID="Scripting.FileSystemObject", lpclsid=0x19f7b0 | out: lpclsid=0x19f7b0*(Data1=0xd43fe01, Data2=0xf093, Data3=0x11cf, Data4=([0]=0x89, [1]=0x40, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0x5, [6]=0x42, [7]=0x28))) returned 0x0 [0079.917] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0079.918] CoCreateInstance (in: rclsid=0x19f7b0*(Data1=0xd43fe01, Data2=0xf093, Data3=0x11cf, Data4=([0]=0x89, [1]=0x40, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0x5, [6]=0x42, [7]=0x28)), pUnkOuter=0x0, dwClsContext=0x5, riid=0x6601a460*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f854 | out: ppv=0x19f854*=0x2011130) returned 0x0 [0081.036] FileSystemObject:IUnknown:QueryInterface (in: This=0x2011130, riid=0x66030540*(Data1=0x7fd52380, Data2=0x4e07, Data3=0x101b, Data4=([0]=0xae, [1]=0x2d, [2]=0x8, [3]=0x0, [4]=0x2b, [5]=0x2e, [6]=0xc7, [7]=0x13)), ppvObject=0x19f864 | out: ppvObject=0x19f864*=0x0) returned 0x80004002 [0081.036] FileSystemObject:IUnknown:QueryInterface (in: This=0x2011130, riid=0x66030750*(Data1=0x37d84f60, Data2=0x42cb, Data3=0x11ce, Data4=([0]=0x81, [1]=0x35, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xb8, [7]=0x51)), ppvObject=0x19f868 | out: ppvObject=0x19f868*=0x0) returned 0x80004002 [0081.036] FileSystemObject:IUnknown:QueryInterface (in: This=0x2011130, riid=0x66030450*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f834 | out: ppvObject=0x19f834*=0x2011130) returned 0x0 [0081.036] FileSystemObject:IUnknown:Release (This=0x2011130) returned 0x1 [0081.037] FileSystemObject:IUnknown:AddRef (This=0x2011130) returned 0x2 [0081.037] FileSystemObject:IUnknown:Release (This=0x2011130) returned 0x1 [0081.038] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x2011130, riid=0x6601aea8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x19f83c*="FolderExists", cNames=0x1, lcid=0x409, rgDispId=0x19f840 | out: rgDispId=0x19f840*=10017) returned 0x0 [0081.038] FileSystemObject:IDispatch:Invoke (in: This=0x2011130, dispIdMember=10017, riid=0x6601aea8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x19f810*(rgvarg=([0]=0x19f85c*(varType=0x4008, wReserved1=0x0, wReserved2=0x10fc, wReserved3=0x78, varVal1=0x19f8fc*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\cf\\", varVal2=0x19f8a4)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x19f88c, pExcepInfo=0x19f7f0, puArgErr=0x19f820 | out: pDispParams=0x19f810*(rgvarg=([0]=0x19f85c*(varType=0x4008, wReserved1=0x0, wReserved2=0x10fc, wReserved3=0x78, varVal1=0x19f8fc*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\cf\\", varVal2=0x19f8a4)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x19f88c*(varType=0xb, wReserved1=0x0, wReserved2=0xd, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pExcepInfo=0x19f7f0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x19f820*=0x661078d9) returned 0x0 [0081.075] FileSystemObject:IUnknown:Release (This=0x2011130) returned 0x0 [0081.075] CLSIDFromProgIDEx (in: lpszProgID="Scripting.FileSystemObject", lpclsid=0x19f794 | out: lpclsid=0x19f794*(Data1=0xd43fe01, Data2=0xf093, Data3=0x11cf, Data4=([0]=0x89, [1]=0x40, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0x5, [6]=0x42, [7]=0x28))) returned 0x0 [0081.076] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0081.076] CoCreateInstance (in: rclsid=0x19f794*(Data1=0xd43fe01, Data2=0xf093, Data3=0x11cf, Data4=([0]=0x89, [1]=0x40, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0x5, [6]=0x42, [7]=0x28)), pUnkOuter=0x0, dwClsContext=0x5, riid=0x6601a460*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f838 | out: ppv=0x19f838*=0x2011130) returned 0x0 [0081.078] FileSystemObject:IUnknown:QueryInterface (in: This=0x2011130, riid=0x66030540*(Data1=0x7fd52380, Data2=0x4e07, Data3=0x101b, Data4=([0]=0xae, [1]=0x2d, [2]=0x8, [3]=0x0, [4]=0x2b, [5]=0x2e, [6]=0xc7, [7]=0x13)), ppvObject=0x19f848 | out: ppvObject=0x19f848*=0x0) returned 0x80004002 [0081.078] FileSystemObject:IUnknown:QueryInterface (in: This=0x2011130, riid=0x66030750*(Data1=0x37d84f60, Data2=0x42cb, Data3=0x11ce, Data4=([0]=0x81, [1]=0x35, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xb8, [7]=0x51)), ppvObject=0x19f84c | out: ppvObject=0x19f84c*=0x0) returned 0x80004002 [0081.078] FileSystemObject:IUnknown:QueryInterface (in: This=0x2011130, riid=0x66030450*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f818 | out: ppvObject=0x19f818*=0x2011130) returned 0x0 [0081.078] FileSystemObject:IUnknown:Release (This=0x2011130) returned 0x1 [0081.078] FileSystemObject:IUnknown:AddRef (This=0x2011130) returned 0x2 [0081.078] FileSystemObject:IUnknown:Release (This=0x2011130) returned 0x1 [0081.078] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x2011130, riid=0x6601aea8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x19f820*="FolderExists", cNames=0x1, lcid=0x409, rgDispId=0x19f824 | out: rgDispId=0x19f824*=10017) returned 0x0 [0081.079] FileSystemObject:IDispatch:Invoke (in: This=0x2011130, dispIdMember=10017, riid=0x6601aea8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x19f7f4*(rgvarg=([0]=0x19f840*(varType=0x4008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x19f8f0*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\cf\\", varVal2=0x8)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x19f888, pExcepInfo=0x19f7d4, puArgErr=0x19f804 | out: pDispParams=0x19f7f4*(rgvarg=([0]=0x19f840*(varType=0x4008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x19f8f0*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\cf\\", varVal2=0x8)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x19f888*(varType=0xb, wReserved1=0x0, wReserved2=0xd1f0, wReserved3=0x756d, varVal1=0x0, varVal2=0x0), pExcepInfo=0x19f7d4*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x19f804*=0x661078d9) returned 0x0 [0081.079] VarNot (in: pvarIn=0x19f888, pvarResult=0x19f878 | out: pvarResult=0x19f878) returned 0x0 [0081.079] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x2011130, riid=0x6601aea8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x19f820*="CreateFolder", cNames=0x1, lcid=0x409, rgDispId=0x19f824 | out: rgDispId=0x19f824*=1120) returned 0x0 [0081.079] FileSystemObject:IDispatch:Invoke (in: This=0x2011130, dispIdMember=1120, riid=0x6601aea8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x19f7f4*(rgvarg=([0]=0x19f840*(varType=0x4008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x19f8f0*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\cf\\", varVal2=0x8)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x19f888, pExcepInfo=0x19f7d4, puArgErr=0x19f804 | out: pDispParams=0x19f7f4*(rgvarg=([0]=0x19f840*(varType=0x4008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x19f8f0*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\cf\\", varVal2=0x8)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x19f888*(varType=0x9, wReserved1=0x0, wReserved2=0xd1f0, wReserved3=0x756d, varVal1=0x2012534, varVal2=0x0), pExcepInfo=0x19f7d4*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x19f804*=0x661078d9) returned 0x0 [0081.081] FileSystemObject:IDispatch:Invoke (in: This=0x2012534, dispIdMember=0, riid=0x6601aea8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x19f794*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x19f7d8, pExcepInfo=0x19f810, puArgErr=0x19f7c8 | out: pDispParams=0x19f794*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x19f7d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\cf" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\cf"), varVal2=0x0), pExcepInfo=0x19f810*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x19f7c8*=0x19f810) returned 0x0 [0081.083] FileSystemObject:IUnknown:Release (This=0x2012534) returned 0x0 [0081.083] FileSystemObject:IUnknown:Release (This=0x2011130) returned 0x0 [0081.083] GetModuleFileNameA (in: hModule=0x400000, lpFilename=0x19f678, nSize=0x104 | out: lpFilename="C:\\Users\\RDhJ0CNFevzX\\Desktop\\de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797.exe")) returned 0x62 [0081.084] lstrcpynA (in: lpString1=0x19f564, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797.exe", iMaxLength=260 | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797.exe") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797.exe" [0081.084] lstrlenA (lpString="C:\\Users\\RDhJ0CNFevzX\\Desktop\\de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797.exe") returned 98 [0081.084] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x63) returned 0x1f1fde8 [0081.084] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x63) returned 0x1f1fe58 [0081.084] lstrcpyA (in: lpString1=0x1f1fde8, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797.exe" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797.exe") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797.exe" [0081.084] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x41) returned 0x1f1fec8 [0081.084] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f1fe58 | out: hHeap=0x28b0000) returned 1 [0081.084] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f1fde8 | out: hHeap=0x28b0000) returned 1 [0081.084] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1f1fec8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 65 [0081.084] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1f1fec8, cbMultiByte=-1, lpWideCharStr=0x72bb3c, cchWideChar=65 | out: lpWideCharStr="de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797") returned 65 [0081.084] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f1fec8 | out: hHeap=0x28b0000) returned 1 [0081.084] GetModuleFileNameA (in: hModule=0x400000, lpFilename=0x19f678, nSize=0x104 | out: lpFilename="C:\\Users\\RDhJ0CNFevzX\\Desktop\\de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797.exe")) returned 0x62 [0081.084] lstrcpynA (in: lpString1=0x19f564, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797.exe", iMaxLength=260 | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797.exe") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797.exe" [0081.084] lstrlenA (lpString="C:\\Users\\RDhJ0CNFevzX\\Desktop\\de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797.exe") returned 98 [0081.084] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x63) returned 0x1f1fde8 [0081.084] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x63) returned 0x1f1fe58 [0081.085] lstrcpyA (in: lpString1=0x1f1fde8, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797.exe" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797.exe") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797.exe" [0081.085] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x1e) returned 0x1f1fec8 [0081.085] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f1fe58 | out: hHeap=0x28b0000) returned 1 [0081.085] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f1fde8 | out: hHeap=0x28b0000) returned 1 [0081.085] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1f1fec8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 30 [0081.085] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1f1fec8, cbMultiByte=-1, lpWideCharStr=0x715e4c, cchWideChar=30 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 30 [0081.085] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f1fec8 | out: hHeap=0x28b0000) returned 1 [0081.085] GetUserDefaultLCID () returned 0x409 [0081.085] GetLocaleInfoA (in: Locale=0x409, LCType=0x1004, lpLCData=0x19f69c, cchData=6 | out: lpLCData="1252") returned 5 [0081.085] SysStringLen (param_1="xrkxjpwnv") returned 0x9 [0081.085] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="xrkxjpwnv", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0081.085] SysStringLen (param_1="xrkxjpwnv") returned 0x9 [0081.085] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="xrkxjpwnv", cchWideChar=10, lpMultiByteStr=0x70ea6c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xrkxjpwnv", lpUsedDefaultChar=0x0) returned 10 [0081.085] SafeArrayAllocDescriptorEx (in: vt=0x11, cDims=0x1, ppsaOut=0x19f6ac | out: ppsaOut=0x19f6ac) returned 0x0 [0081.085] GetUserDefaultLCID () returned 0x409 [0081.085] GetLocaleInfoA (in: Locale=0x409, LCType=0x1004, lpLCData=0x19f69c, cchData=6 | out: lpLCData="1252") returned 5 [0081.086] SysStringLen (param_1="“") returned 0x1 [0081.086] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="“", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0081.086] SysStringLen (param_1="“") returned 0x1 [0081.086] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="“", cchWideChar=2, lpMultiByteStr=0x70ea6c, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x93", lpUsedDefaultChar=0x0) returned 2 [0081.086] SafeArrayAllocDescriptorEx (in: vt=0x11, cDims=0x1, ppsaOut=0x19f6ac | out: ppsaOut=0x19f6ac) returned 0x0 [0081.086] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x4106e0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0081.086] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x4106e0, cbMultiByte=-1, lpWideCharStr=0x783214, cchWideChar=11 | out: lpWideCharStr="ExtendeRTF") returned 11 [0081.087] RaiseException (dwExceptionCode=0xc000008f, dwExceptionFlags=0x1, nNumberOfArguments=0x2, lpArguments=0x19f690) [0081.087] RtlUnwind (TargetFrame=0x19f7e8, TargetIp=0x66103caf, ExceptionRecord=0x0, ReturnValue=0x0) [0081.087] GetUserDefaultLCID () returned 0x409 [0081.087] GetLocaleInfoA (in: Locale=0x409, LCType=0x1004, lpLCData=0x19f69c, cchData=6 | out: lpLCData="1252") returned 5 [0081.087] SysStringByteLen (bstr="\\") returned 0x1 [0081.087] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x70ea6c, cbMultiByte=1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0081.087] SysStringByteLen (bstr="\\") returned 0x1 [0081.087] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x70ea6c, cbMultiByte=2, lpWideCharStr=0x70eb8c, cchWideChar=3 | out: lpWideCharStr="\\") returned 2 [0081.087] SafeArrayDestroyDescriptor (psa=0x719668) returned 0x0 [0081.088] SafeArrayDestroyDescriptor (psa=0x719518) returned 0x0 [0081.088] GetUserDefaultLCID () returned 0x409 [0081.088] GetLocaleInfoA (in: Locale=0x409, LCType=0x1004, lpLCData=0x19f69c, cchData=6 | out: lpLCData="1252") returned 5 [0081.088] SysStringLen (param_1="xrkxjpwnv") returned 0x9 [0081.088] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="xrkxjpwnv", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0081.088] SysStringLen (param_1="xrkxjpwnv") returned 0x9 [0081.088] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="xrkxjpwnv", cchWideChar=10, lpMultiByteStr=0x70ea84, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xrkxjpwnv", lpUsedDefaultChar=0x0) returned 10 [0081.088] SafeArrayAllocDescriptorEx (in: vt=0x11, cDims=0x1, ppsaOut=0x19f6ac | out: ppsaOut=0x19f6ac) returned 0x0 [0081.088] GetUserDefaultLCID () returned 0x409 [0081.088] GetLocaleInfoA (in: Locale=0x409, LCType=0x1004, lpLCData=0x19f69c, cchData=6 | out: lpLCData="1252") returned 5 [0081.088] SysStringLen (param_1="áí¤\x1f") returned 0x4 [0081.088] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="áí¤\x1f", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0081.088] SysStringLen (param_1="áí¤\x1f") returned 0x4 [0081.088] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="áí¤\x1f", cchWideChar=5, lpMultiByteStr=0x70ea84, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="áí¤\x1f", lpUsedDefaultChar=0x0) returned 5 [0081.088] SafeArrayAllocDescriptorEx (in: vt=0x11, cDims=0x1, ppsaOut=0x19f6ac | out: ppsaOut=0x19f6ac) returned 0x0 [0081.089] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x4106e0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0081.089] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x4106e0, cbMultiByte=-1, lpWideCharStr=0x6faa9c, cchWideChar=11 | out: lpWideCharStr="ExtendeRTF") returned 11 [0081.089] RaiseException (dwExceptionCode=0xc000008f, dwExceptionFlags=0x1, nNumberOfArguments=0x2, lpArguments=0x19f690) [0081.089] RtlUnwind (TargetFrame=0x19f7e8, TargetIp=0x66103caf, ExceptionRecord=0x0, ReturnValue=0x0) [0081.089] GetUserDefaultLCID () returned 0x409 [0081.089] GetLocaleInfoA (in: Locale=0x409, LCType=0x1004, lpLCData=0x19f69c, cchData=6 | out: lpLCData="1252") returned 5 [0081.089] SysStringByteLen (bstr="攮數") returned 0x4 [0081.089] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x70ea84, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0081.090] SysStringByteLen (bstr="攮數") returned 0x4 [0081.090] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x70ea84, cbMultiByte=5, lpWideCharStr=0x72befc, cchWideChar=9 | out: lpWideCharStr=".exe") returned 5 [0081.090] SafeArrayDestroyDescriptor (psa=0x719668) returned 0x0 [0081.090] SafeArrayDestroyDescriptor (psa=0x719458) returned 0x0 [0081.090] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\cf\\ct.exe", cchWideChar=-1, lpMultiByteStr=0x19f560, cbMultiByte=261, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\cf\\ct.exe", lpUsedDefaultChar=0x0) returned 48 [0081.090] GetFullPathNameA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\cf\\ct.exe", nBufferLength=0x104, lpBuffer=0x19f7a0, lpFilePart=0x19f558 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\cf\\ct.exe", lpFilePart=0x19f558*="ct.exe") returned 0x2f [0081.091] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797.exe", cchWideChar=-1, lpMultiByteStr=0x19f560, cbMultiByte=261, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797.exe", lpUsedDefaultChar=0x0) returned 99 [0081.091] GetFullPathNameA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797.exe", nBufferLength=0x104, lpBuffer=0x19f698, lpFilePart=0x19f558 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797.exe", lpFilePart=0x19f558*="de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797.exe") returned 0x62 [0081.091] IMalloc:Alloc (This=0x75638d00, cb=0xfe00) returned 0x7540b0 [0081.092] CreateFileA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x19f658, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0081.092] GetFileType (hFile=0x194) returned 0x1 [0081.092] CreateFileA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\cf\\ct.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\cf\\ct.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x19f658, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0081.093] GetFileType (hFile=0x190) returned 0x1 [0081.093] ReadFile (in: hFile=0x194, lpBuffer=0x7540b0, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x19f64c, lpOverlapped=0x0 | out: lpBuffer=0x7540b0*, lpNumberOfBytesRead=0x19f64c*=0xfe00, lpOverlapped=0x0) returned 1 [0081.094] WriteFile (in: hFile=0x190, lpBuffer=0x7540b0*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x19f244, lpOverlapped=0x0 | out: lpBuffer=0x7540b0*, lpNumberOfBytesWritten=0x19f244*=0xfe00, lpOverlapped=0x0) returned 1 [0081.096] ReadFile (in: hFile=0x194, lpBuffer=0x7540b0, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x19f64c, lpOverlapped=0x0 | out: lpBuffer=0x7540b0*, lpNumberOfBytesRead=0x19f64c*=0xfe00, lpOverlapped=0x0) returned 1 [0081.096] WriteFile (in: hFile=0x190, lpBuffer=0x7540b0*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x19f244, lpOverlapped=0x0 | out: lpBuffer=0x7540b0*, lpNumberOfBytesWritten=0x19f244*=0xfe00, lpOverlapped=0x0) returned 1 [0081.098] ReadFile (in: hFile=0x194, lpBuffer=0x7540b0, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x19f64c, lpOverlapped=0x0 | out: lpBuffer=0x7540b0*, lpNumberOfBytesRead=0x19f64c*=0xfe00, lpOverlapped=0x0) returned 1 [0081.098] WriteFile (in: hFile=0x190, lpBuffer=0x7540b0*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x19f244, lpOverlapped=0x0 | out: lpBuffer=0x7540b0*, lpNumberOfBytesWritten=0x19f244*=0xfe00, lpOverlapped=0x0) returned 1 [0081.100] ReadFile (in: hFile=0x194, lpBuffer=0x7540b0, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x19f64c, lpOverlapped=0x0 | out: lpBuffer=0x7540b0*, lpNumberOfBytesRead=0x19f64c*=0xfe00, lpOverlapped=0x0) returned 1 [0081.100] WriteFile (in: hFile=0x190, lpBuffer=0x7540b0*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x19f244, lpOverlapped=0x0 | out: lpBuffer=0x7540b0*, lpNumberOfBytesWritten=0x19f244*=0xfe00, lpOverlapped=0x0) returned 1 [0081.102] ReadFile (in: hFile=0x194, lpBuffer=0x7540b0, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x19f64c, lpOverlapped=0x0 | out: lpBuffer=0x7540b0*, lpNumberOfBytesRead=0x19f64c*=0xfe00, lpOverlapped=0x0) returned 1 [0081.102] WriteFile (in: hFile=0x190, lpBuffer=0x7540b0*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x19f244, lpOverlapped=0x0 | out: lpBuffer=0x7540b0*, lpNumberOfBytesWritten=0x19f244*=0xfe00, lpOverlapped=0x0) returned 1 [0081.104] ReadFile (in: hFile=0x194, lpBuffer=0x7540b0, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x19f64c, lpOverlapped=0x0 | out: lpBuffer=0x7540b0*, lpNumberOfBytesRead=0x19f64c*=0xfe00, lpOverlapped=0x0) returned 1 [0081.105] WriteFile (in: hFile=0x190, lpBuffer=0x7540b0*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x19f244, lpOverlapped=0x0 | out: lpBuffer=0x7540b0*, lpNumberOfBytesWritten=0x19f244*=0xfe00, lpOverlapped=0x0) returned 1 [0081.106] ReadFile (in: hFile=0x194, lpBuffer=0x7540b0, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x19f64c, lpOverlapped=0x0 | out: lpBuffer=0x7540b0*, lpNumberOfBytesRead=0x19f64c*=0xfe00, lpOverlapped=0x0) returned 1 [0081.106] WriteFile (in: hFile=0x190, lpBuffer=0x7540b0*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x19f244, lpOverlapped=0x0 | out: lpBuffer=0x7540b0*, lpNumberOfBytesWritten=0x19f244*=0xfe00, lpOverlapped=0x0) returned 1 [0081.108] ReadFile (in: hFile=0x194, lpBuffer=0x7540b0, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x19f64c, lpOverlapped=0x0 | out: lpBuffer=0x7540b0*, lpNumberOfBytesRead=0x19f64c*=0xfe00, lpOverlapped=0x0) returned 1 [0081.108] WriteFile (in: hFile=0x190, lpBuffer=0x7540b0*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x19f244, lpOverlapped=0x0 | out: lpBuffer=0x7540b0*, lpNumberOfBytesWritten=0x19f244*=0xfe00, lpOverlapped=0x0) returned 1 [0081.109] ReadFile (in: hFile=0x194, lpBuffer=0x7540b0, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x19f64c, lpOverlapped=0x0 | out: lpBuffer=0x7540b0*, lpNumberOfBytesRead=0x19f64c*=0xfe00, lpOverlapped=0x0) returned 1 [0081.110] WriteFile (in: hFile=0x190, lpBuffer=0x7540b0*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x19f244, lpOverlapped=0x0 | out: lpBuffer=0x7540b0*, lpNumberOfBytesWritten=0x19f244*=0xfe00, lpOverlapped=0x0) returned 1 [0081.128] ReadFile (in: hFile=0x194, lpBuffer=0x7540b0, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x19f64c, lpOverlapped=0x0 | out: lpBuffer=0x7540b0*, lpNumberOfBytesRead=0x19f64c*=0xfe00, lpOverlapped=0x0) returned 1 [0081.128] WriteFile (in: hFile=0x190, lpBuffer=0x7540b0*, nNumberOfBytesToWrite=0xfe00, lpNumberOfBytesWritten=0x19f244, lpOverlapped=0x0 | out: lpBuffer=0x7540b0*, lpNumberOfBytesWritten=0x19f244*=0xfe00, lpOverlapped=0x0) returned 1 [0081.130] ReadFile (in: hFile=0x194, lpBuffer=0x7540b0, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x19f64c, lpOverlapped=0x0 | out: lpBuffer=0x7540b0*, lpNumberOfBytesRead=0x19f64c*=0x3da8, lpOverlapped=0x0) returned 1 [0081.130] WriteFile (in: hFile=0x190, lpBuffer=0x7540b0*, nNumberOfBytesToWrite=0x3da8, lpNumberOfBytesWritten=0x19f244, lpOverlapped=0x0 | out: lpBuffer=0x7540b0*, lpNumberOfBytesWritten=0x19f244*=0x3da8, lpOverlapped=0x0) returned 1 [0081.131] ReadFile (in: hFile=0x194, lpBuffer=0x7540b0, nNumberOfBytesToRead=0xfe00, lpNumberOfBytesRead=0x19f64c, lpOverlapped=0x0 | out: lpBuffer=0x7540b0*, lpNumberOfBytesRead=0x19f64c*=0x0, lpOverlapped=0x0) returned 1 [0081.131] CloseHandle (hObject=0x190) returned 1 [0081.149] CloseHandle (hObject=0x194) returned 1 [0081.149] IMalloc:Free (This=0x75638d00, pv=0x7540b0) [0081.150] CreateFileA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0081.150] CreateFileA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\cf\\ct.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\cf\\ct.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0081.150] GetFileTime (in: hFile=0x194, lpCreationTime=0x19f660, lpLastAccessTime=0x19f668, lpLastWriteTime=0x19f670 | out: lpCreationTime=0x19f660*(dwLowDateTime=0x3d8d9000, dwHighDateTime=0x1d7b42b), lpLastAccessTime=0x19f668*(dwLowDateTime=0x3d8d9000, dwHighDateTime=0x1d7b42b), lpLastWriteTime=0x19f670*(dwLowDateTime=0x2c3b8800, dwHighDateTime=0x1d7b419)) returned 1 [0081.150] SetFileTime (hFile=0x190, lpCreationTime=0x19f660, lpLastAccessTime=0x19f668, lpLastWriteTime=0x19f670) returned 1 [0081.151] CloseHandle (hObject=0x194) returned 1 [0081.151] CloseHandle (hObject=0x190) returned 1 [0081.151] CLSIDFromProgIDEx (in: lpszProgID="WScript.shell", lpclsid=0x19f868 | out: lpclsid=0x19f868*(Data1=0x72c24dd5, Data2=0xd70a, Data3=0x438b, Data4=([0]=0x8a, [1]=0x42, [2]=0x98, [3]=0x42, [4]=0x4b, [5]=0x88, [6]=0xaf, [7]=0xb8))) returned 0x0 [0081.153] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0081.153] CoCreateInstance (in: rclsid=0x19f868*(Data1=0x72c24dd5, Data2=0xd70a, Data3=0x438b, Data4=([0]=0x8a, [1]=0x42, [2]=0x98, [3]=0x42, [4]=0x4b, [5]=0x88, [6]=0xaf, [7]=0xb8)), pUnkOuter=0x0, dwClsContext=0x5, riid=0x6601a460*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f90c | out: ppv=0x19f90c*=0x201113c) returned 0x0 [0087.255] WshShell:IUnknown:QueryInterface (in: This=0x201113c, riid=0x66030540*(Data1=0x7fd52380, Data2=0x4e07, Data3=0x101b, Data4=([0]=0xae, [1]=0x2d, [2]=0x8, [3]=0x0, [4]=0x2b, [5]=0x2e, [6]=0xc7, [7]=0x13)), ppvObject=0x19f91c | out: ppvObject=0x19f91c*=0x0) returned 0x80004002 [0087.255] WshShell:IUnknown:QueryInterface (in: This=0x201113c, riid=0x66030750*(Data1=0x37d84f60, Data2=0x42cb, Data3=0x11ce, Data4=([0]=0x81, [1]=0x35, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xb8, [7]=0x51)), ppvObject=0x19f920 | out: ppvObject=0x19f920*=0x0) returned 0x80004002 [0087.255] WshShell:IUnknown:QueryInterface (in: This=0x201113c, riid=0x66030450*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f8ec | out: ppvObject=0x19f8ec*=0x2011128) returned 0x0 [0087.255] WshShell:IUnknown:Release (This=0x201113c) returned 0x1 [0087.255] WshShell:IDispatch:GetIDsOfNames (in: This=0x2011128, riid=0x6601aea8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x19f8d8*="RegWrite", cNames=0x1, lcid=0x409, rgDispId=0x19f8dc | out: rgDispId=0x19f8dc*=2001) returned 0x0 [0087.262] WshShell:IDispatch:Invoke (in: This=0x2011128, dispIdMember=2001, riid=0x6601aea8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0x19f8ac*(rgvarg=([0]=0x19f8f4*(varType=0x8, wReserved1=0x0, wReserved2=0xfa8c, wReserved3=0x19, varVal1="REG_SZ", varVal2=0x1f1f924), [1]=0x19f904*(varType=0x8, wReserved1=0x0, wReserved2=0xc410, wReserved3=0x660d, varVal1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\cf\\ct.exe", varVal2=0x41a4a0), [2]=0x19f914*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\cp", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x3, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x19f88c, puArgErr=0x19f8bc | out: pDispParams=0x19f8ac*(rgvarg=([0]=0x19f8f4*(varType=0x8, wReserved1=0x0, wReserved2=0xfa8c, wReserved3=0x19, varVal1="REG_SZ", varVal2=0x1f1f924), [1]=0x19f904*(varType=0x8, wReserved1=0x0, wReserved2=0xc410, wReserved3=0x660d, varVal1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\cf\\ct.exe", varVal2=0x41a4a0), [2]=0x19f914*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\cp", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x3, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x19f88c*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x19f8bc*=0x661078d9) returned 0x0 [0087.263] VarBstrCmp (bstrLeft="net4", bstrRight="self", lcid=0x0, dwFlags=0x30001) returned 0x0 [0087.263] VarBstrCmp (bstrLeft="net4", bstrRight="net4", lcid=0x0, dwFlags=0x30001) returned 0x1 [0087.263] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="WinDir", cchWideChar=7, lpMultiByteStr=0x19f884, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WinDir", lpUsedDefaultChar=0x0) returned 7 [0087.264] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="PUBLIC=C:\\Users\\Public", cchCount1=6, lpString2="WinDir", cchCount2=6) returned 1 [0087.264] CompareStringA (Locale=0x0, dwCmpFlags=0x1, lpString1="windir=C:\\Windows", cchCount1=6, lpString2="WinDir", cchCount2=6) returned 2 [0087.264] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x20208a7, cbMultiByte=11, lpWideCharStr=0x71647c, cchWideChar=22 | out: lpWideCharStr="C:\\Windows") returned 11 [0087.264] SysReAllocStringLen (in: pbstr=0x19f914*="C:\\Windows", psz=0x0, len=0xa | out: pbstr=0x19f914*="C:\\Windows") returned 1 [0087.264] SetErrorMode (uMode=0x8001) returned 0x8001 [0087.264] LoadLibraryA (lpLibFileName="c:\\windows\\system32\\USER32.DLL") returned 0x74790000 [0087.264] SetErrorMode (uMode=0x8001) returned 0x8001 [0087.264] GetProcAddress (hModule=0x74790000, lpProcName="CallWindowProcW") returned 0x747a6930 [0087.264] CallWindowProcW (lpPrevWndFunc=0x72c480, hWnd=0x748ca8, Msg=0x72bbd4, wParam=0x0, lParam=0x0) returned 0x370 [0087.265] SetErrorMode (uMode=0x8001) returned 0x8001 [0087.265] LoadLibraryA (lpLibFileName="ntdll") returned 0x778f0000 [0087.265] SetErrorMode (uMode=0x8001) returned 0x8001 [0087.265] GetProcAddress (hModule=0x778f0000, lpProcName="NtAllocateVirtualMemory") returned 0x77966e00 [0087.265] NtAllocateVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x19f758*=0x0, ZeroBits=0x0, RegionSize=0x19f760*=0x1000, AllocationType=0x1000, Protect=0x40 | out: BaseAddress=0x19f758*=0x2a40000, RegionSize=0x19f760*=0x1000) returned 0x0 [0087.265] SetErrorMode (uMode=0x8001) returned 0x8001 [0087.265] LoadLibraryA (lpLibFileName="kernel32") returned 0x74650000 [0087.265] SetErrorMode (uMode=0x8001) returned 0x8001 [0087.266] GetProcAddress (hModule=0x74650000, lpProcName="CreateProcessW") returned 0x7466b000 [0087.266] CreateProcessW (in: lpApplicationName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x4, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x2a40048*(cb=0x0, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2a4008c | out: lpCommandLine=0x0, lpProcessInformation=0x2a4008c*(hProcess=0x218, hThread=0x214, dwProcessId=0x370, dwThreadId=0x4d0)) returned 1 [0087.319] SetErrorMode (uMode=0x8001) returned 0x8001 [0087.319] LoadLibraryA (lpLibFileName="ntdll") returned 0x778f0000 [0087.320] SetErrorMode (uMode=0x8001) returned 0x8001 [0087.320] GetProcAddress (hModule=0x778f0000, lpProcName="NtUnmapViewOfSection") returned 0x77966f40 [0087.320] NtUnmapViewOfSection (ProcessHandle=0x218, BaseAddress=0x400000) returned 0x0 [0087.320] NtAllocateVirtualMemory (in: ProcessHandle=0x218, BaseAddress=0x2a40004*=0x400000, ZeroBits=0x0, RegionSize=0x748d78*=0x12000, AllocationType=0x3000, Protect=0x40 | out: BaseAddress=0x2a40004*=0x400000, RegionSize=0x748d78*=0x12000) returned 0x0 [0087.374] SetErrorMode (uMode=0x8001) returned 0x8001 [0087.375] LoadLibraryA (lpLibFileName="ntdll") returned 0x778f0000 [0087.375] SetErrorMode (uMode=0x8001) returned 0x8001 [0087.375] GetProcAddress (hModule=0x778f0000, lpProcName="NtWriteVirtualMemory") returned 0x77967040 [0087.375] NtWriteVirtualMemory (in: ProcessHandle=0x218, BaseAddress=0x400000, Buffer=0x748ca8*, NumberOfBytesToWrite=0x200, NumberOfBytesWritten=0x0 | out: Buffer=0x748ca8*, NumberOfBytesWritten=0x0) returned 0x0 [0087.383] NtWriteVirtualMemory (in: ProcessHandle=0x218, BaseAddress=0x410000, Buffer=0x753ea8*, NumberOfBytesToWrite=0x200, NumberOfBytesWritten=0x0 | out: Buffer=0x753ea8*, NumberOfBytesWritten=0x0) returned 0x0 [0087.530] NtWriteVirtualMemory (in: ProcessHandle=0x218, BaseAddress=0x40e000, Buffer=0x7536a8*, NumberOfBytesToWrite=0x800, NumberOfBytesWritten=0x0 | out: Buffer=0x7536a8*, NumberOfBytesWritten=0x0) returned 0x0 [0087.551] NtWriteVirtualMemory (in: ProcessHandle=0x218, BaseAddress=0x402000, Buffer=0x748ea8*, NumberOfBytesToWrite=0xa800, NumberOfBytesWritten=0x0 | out: Buffer=0x748ea8*, NumberOfBytesWritten=0x0) returned 0x0 [0087.560] SetErrorMode (uMode=0x8001) returned 0x8001 [0087.560] LoadLibraryA (lpLibFileName="ntdll") returned 0x778f0000 [0087.560] SetErrorMode (uMode=0x8001) returned 0x8001 [0087.560] GetProcAddress (hModule=0x778f0000, lpProcName="NtGetContextThread") returned 0x77967ae0 [0087.560] NtGetContextThread (in: ThreadHandle=0x214, Context=0x2a4009c | out: Context=0x2a4009c*(ContextFlags=0x10007, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x2b, SegFs=0x53, SegEs=0x2b, SegDs=0x2b, Edi=0x0, Esi=0x0, Ebx=0x287000, Edx=0x0, Ecx=0x0, Eax=0x40ccb6, Ebp=0x0, Eip=0x77968fe0, SegCs=0x23, EFlags=0x202, Esp=0x19fff0, SegSs=0x2b, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 0x0 [0087.562] NtWriteVirtualMemory (in: ProcessHandle=0x218, BaseAddress=0x287008, Buffer=0x2a40004*, NumberOfBytesToWrite=0x4, NumberOfBytesWritten=0x0 | out: Buffer=0x2a40004*, NumberOfBytesWritten=0x0) returned 0x0 [0087.568] SetErrorMode (uMode=0x8001) returned 0x8001 [0087.568] LoadLibraryA (lpLibFileName="ntdll") returned 0x778f0000 [0087.568] SetErrorMode (uMode=0x8001) returned 0x8001 [0087.568] GetProcAddress (hModule=0x778f0000, lpProcName="NtSetContextThread") returned 0x779683c0 [0087.568] NtSetContextThread (ThreadHandle=0x214, Context=0x2a4009c*(ContextFlags=0x10007, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x2b, SegFs=0x53, SegEs=0x2b, SegDs=0x2b, Edi=0x0, Esi=0x0, Ebx=0x287000, Edx=0x0, Ecx=0x0, Eax=0x40c68e, Ebp=0x0, Eip=0x77968fe0, SegCs=0x23, EFlags=0x202, Esp=0x19fff0, SegSs=0x2b, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 0x0 [0087.575] SetErrorMode (uMode=0x8001) returned 0x8001 [0087.576] LoadLibraryA (lpLibFileName="ntdll") returned 0x778f0000 [0087.576] SetErrorMode (uMode=0x8001) returned 0x8001 [0087.576] GetProcAddress (hModule=0x778f0000, lpProcName="NtResumeThread") returned 0x779671c0 [0087.576] NtResumeThread (in: ThreadHandle=0x214, SuspendCount=0x0 | out: SuspendCount=0x0) returned 0x0 [0087.908] SetErrorMode (uMode=0x8001) returned 0x8001 [0087.908] LoadLibraryA (lpLibFileName="kernel32") returned 0x74650000 [0087.908] SetErrorMode (uMode=0x8001) returned 0x8001 [0087.908] GetProcAddress (hModule=0x74650000, lpProcName="GetExitCodeProcess") returned 0x7466fdb0 [0087.908] GetExitCodeProcess (in: hProcess=0x218, lpExitCode=0x19f76c | out: lpExitCode=0x19f76c*=0x103) returned 1 [0087.908] GetLastError () returned 0x578 [0088.012] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x14) returned 0x1f13a18 [0088.013] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f13a18 | out: hHeap=0x28b0000) returned 1 [0088.016] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f182f0 | out: hHeap=0x28b0000) returned 1 [0088.016] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f16d10 | out: hHeap=0x28b0000) returned 1 [0088.016] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f123c8 | out: hHeap=0x28b0000) returned 1 [0088.016] WshShell:IUnknown:Release (This=0x2011128) returned 0x0 [0088.018] SafeArrayDestroyDescriptor (psa=0x719428) returned 0x0 [0088.019] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f1fda8 | out: hHeap=0x28b0000) returned 1 [0088.020] IMalloc:Free (This=0x75638d00, pv=0x6f6cd0) [0088.027] SafeArrayDestroyDescriptor (psa=0x719578) returned 0x0 [0088.027] GetCurrentThreadId () returned 0xa7c [0088.027] GetCurrentThreadId () returned 0xa7c [0088.028] lstrcmpiA (lpString1="MSFlexGridLib.MSFlexGrid", lpString2="MSFlexGridLib.MSFlexGrid") returned 0 [0088.028] lstrcmpiA (lpString1="MSComDlg.CommonDialog", lpString2="MSComDlg.CommonDialog") returned 0 [0088.028] lstrcmpiA (lpString1="MSComctlLib.TabStrip", lpString2="MSComctlLib.TabStrip") returned 0 [0088.028] lstrcmpiA (lpString1="MSComctlLib.Toolbar", lpString2="MSComctlLib.Toolbar") returned 0 [0088.028] lstrcmpiA (lpString1="MSComctlLib.StatusBar", lpString2="MSComctlLib.StatusBar") returned 0 [0088.028] lstrcmpiA (lpString1="MSComctlLib.ProgressBar", lpString2="MSComctlLib.ProgressBar") returned 0 [0088.028] lstrcmpiA (lpString1="MSComctlLib.TreeView", lpString2="MSComctlLib.TreeView") returned 0 [0088.028] lstrcmpiA (lpString1="MSComctlLib.ListView", lpString2="MSComctlLib.ListView") returned 0 [0088.028] lstrcmpiA (lpString1="VB.Form", lpString2="MSComctlLib.ImageList") returned 1 [0088.028] lstrcmpiA (lpString1="MSComctlLib.ImageList", lpString2="MSComctlLib.ImageList") returned 0 [0088.028] lstrcmpiA (lpString1="MSComctlLib.Slider", lpString2="MSComctlLib.Slider") returned 0 [0088.029] lstrcmpiA (lpString1="MSComctlLib.ImageCombo", lpString2="MSComctlLib.ImageCombo") returned 0 [0088.029] lstrcmpiA (lpString1="MSComCtl2.Animation", lpString2="MSComCtl2.Animation") returned 0 [0088.029] lstrcmpiA (lpString1="MSComCtl2.UpDown", lpString2="MSComCtl2.UpDown") returned 0 [0088.029] lstrcmpiA (lpString1="MSComCtl2.MonthView", lpString2="MSComCtl2.MonthView") returned 0 [0088.029] lstrcmpiA (lpString1="MSComCtl2.DTPicker", lpString2="MSComCtl2.DTPicker") returned 0 [0088.029] lstrcmpiA (lpString1="VB.Form", lpString2="MSComCtl2.FlatScrollBar") returned 1 [0088.029] lstrcmpiA (lpString1="MSComctlLib.ImageList", lpString2="MSComCtl2.FlatScrollBar") returned 1 [0088.029] lstrcmpiA (lpString1="MSComCtl2.FlatScrollBar", lpString2="MSComCtl2.FlatScrollBar") returned 0 [0088.029] lstrcmpiA (lpString1="VB.CommandButton", lpString2="InetCtlsObjects.Inet") returned 1 [0088.029] lstrcmpiA (lpString1="InetCtlsObjects.Inet", lpString2="InetCtlsObjects.Inet") returned 0 [0088.029] lstrcmpiA (lpString1="RichTextLib.RichTextBox", lpString2="RichTextLib.RichTextBox") returned 0 [0088.029] lstrcmpiA (lpString1="MSChart20Lib.MSChart", lpString2="MSChart20Lib.MSChart") returned 0 [0088.030] lstrcmpiA (lpString1="MSFlexGridLib.MSFlexGrid", lpString2="MSWinsockLib.Winsock") returned -1 [0088.030] lstrcmpiA (lpString1="MSWinsockLib.Winsock", lpString2="MSWinsockLib.Winsock") returned 0 [0088.030] lstrcmpiA (lpString1="MSMAPI.MAPISession", lpString2="MSMAPI.MAPISession") returned 0 [0088.030] lstrcmpiA (lpString1="MSMAPI.MAPISession", lpString2="MSMAPI.MAPIMessages") returned 1 [0088.030] lstrcmpiA (lpString1="MSMAPI.MAPIMessages", lpString2="MSMAPI.MAPIMessages") returned 0 [0088.030] lstrcmpiA (lpString1="MCI.MMControl", lpString2="MCI.MMControl") returned 0 [0088.030] lstrcmpiA (lpString1="PicClip.PictureClip", lpString2="PicClip.PictureClip") returned 0 [0088.030] lstrcmpiA (lpString1="VB.Form", lpString2="MSCommLib.MSComm") returned 1 [0088.030] lstrcmpiA (lpString1="MSComctlLib.ImageList", lpString2="MSCommLib.MSComm") returned -1 [0088.030] lstrcmpiA (lpString1="MSComCtl2.FlatScrollBar", lpString2="MSCommLib.MSComm") returned -1 [0088.030] lstrcmpiA (lpString1="MSCommLib.MSComm", lpString2="MSCommLib.MSComm") returned 0 [0088.030] lstrcmpiA (lpString1="MSMask.MaskEdBox", lpString2="MSMask.MaskEdBox") returned 0 [0088.030] lstrcmpiA (lpString1="VB.MDIForm", lpString2="MSDataGridLib.DataGrid") returned 1 [0088.030] lstrcmpiA (lpString1="VB.PropertyPage", lpString2="MSDataGridLib.DataGrid") returned 1 [0088.030] lstrcmpiA (lpString1="MSDataGridLib.DataGrid", lpString2="MSDataGridLib.DataGrid") returned 0 [0088.030] lstrcmpiA (lpString1="MSDataListLib.DataList", lpString2="MSDataListLib.DataList") returned 0 [0088.031] lstrcmpiA (lpString1="MSDataListLib.DataCombo", lpString2="MSDataListLib.DataCombo") returned 0 [0088.031] lstrcmpiA (lpString1="ComCtl3.CoolBar", lpString2="ComCtl3.CoolBar") returned 0 [0088.031] lstrcmpiA (lpString1="VB.CommandButton", lpString2="MSHierarchicalFlexGridLib.MSHFlexGrid") returned 1 [0088.031] lstrcmpiA (lpString1="InetCtlsObjects.Inet", lpString2="MSHierarchicalFlexGridLib.MSHFlexGrid") returned -1 [0088.031] lstrcmpiA (lpString1="MSHierarchicalFlexGridLib.MSHFlexGrid", lpString2="MSHierarchicalFlexGridLib.MSHFlexGrid") returned 0 [0088.031] lstrcmpiA (lpString1="AnimatedGIF.DXAnimatedGIF", lpString2="AnimatedGIF.DXAnimatedGIF") returned 0 [0088.031] lstrcmpiA (lpString1="MSComctlLib.Toolbar", lpString2="Boton2007.Boton") returned 1 [0088.031] lstrcmpiA (lpString1="Boton2007.Boton", lpString2="Boton2007.Boton") returned 0 [0088.031] lstrcmpiA (lpString1="MSComctlLib.TreeView", lpString2="Proyecto1.ButtonOffice") returned -1 [0088.031] lstrcmpiA (lpString1="Proyecto1.ButtonOffice", lpString2="Proyecto1.ButtonOffice") returned 0 [0088.031] IMalloc:Alloc (This=0x75638d00, cb=0x720) returned 0x748a98 [0088.032] IMalloc:Alloc (This=0x75638d00, cb=0x1000) returned 0x7491c0 [0088.032] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x18) returned 0x1f13878 [0088.032] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x4) returned 0x28bd140 [0088.032] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x10) returned 0x1f1b668 [0088.032] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f1b668 | out: hHeap=0x28b0000) returned 1 [0088.032] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28bd140 | out: hHeap=0x28b0000) returned 1 [0088.032] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f13878 | out: hHeap=0x28b0000) returned 1 [0088.032] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x18) returned 0x1f13858 [0088.032] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x4) returned 0x28bd140 [0088.032] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x10) returned 0x1f1b620 [0088.032] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f1b620 | out: hHeap=0x28b0000) returned 1 [0088.032] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28bd140 | out: hHeap=0x28b0000) returned 1 [0088.032] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f13858 | out: hHeap=0x28b0000) returned 1 [0088.032] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x18) returned 0x1f13ad8 [0088.032] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x4) returned 0x28bd140 [0088.032] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x8, Size=0x10) returned 0x1f1b680 [0088.032] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f1b680 | out: hHeap=0x28b0000) returned 1 [0088.032] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28bd140 | out: hHeap=0x28b0000) returned 1 [0088.032] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f13ad8 | out: hHeap=0x28b0000) returned 1 [0088.032] IMalloc:Alloc (This=0x75638d00, cb=0x60) returned 0x72f918 [0088.033] IMalloc:GetSize (This=0x75638d00, pv=0x72f918) returned 0x60 [0088.033] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x4106e0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0088.033] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x4106e0, cbMultiByte=-1, lpWideCharStr=0x7834e4, cchWideChar=11 | out: lpWideCharStr="ExtendeRTF") returned 11 [0088.033] RaiseException (dwExceptionCode=0xc000008f, dwExceptionFlags=0x1, nNumberOfArguments=0x2, lpArguments=0x19fa6c) [0088.033] RtlUnwind (TargetFrame=0x19fac0, TargetIp=0x66103caf, ExceptionRecord=0x0, ReturnValue=0x0) [0088.033] CreateErrorInfo (in: pperrinfo=0x19eccc | out: pperrinfo=0x19eccc*=0x72fb3c) returned 0x0 [0088.034] LoadStringA (in: hInstance=0x66000000, uID=0x2738, lpBuffer=0x19e810, cchBufferMax=500 | out: lpBuffer="Application-defined or object-defined error") returned 0x2b [0088.036] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19e810, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 44 [0088.036] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19e810, cbMultiByte=-1, lpWideCharStr=0x71973c, cchWideChar=44 | out: lpWideCharStr="Application-defined or object-defined error") returned 44 [0088.036] ICreateErrorInfo:SetGuid (This=0x72fb3c, rguid=0x6601aea8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0088.036] ICreateErrorInfo:SetSource (This=0x72fb3c, szSource="ExtendeRTF") returned 0x0 [0088.036] ICreateErrorInfo:SetDescription (This=0x72fb3c, szDescription="Application-defined or object-defined error") returned 0x0 [0088.036] ICreateErrorInfo:SetHelpFile (This=0x72fb3c, szHelpFile=0x0) returned 0x0 [0088.036] ICreateErrorInfo:SetHelpContext (This=0x72fb3c, dwHelpContext=0xf429f) returned 0x0 [0088.036] IUnknown:QueryInterface (in: This=0x72fb3c, riid=0x660306e0*(Data1=0x1cf2b120, Data2=0x547d, Data3=0x101b, Data4=([0]=0x8e, [1]=0x65, [2]=0x8, [3]=0x0, [4]=0x2b, [5]=0x2b, [6]=0xd1, [7]=0x19)), ppvObject=0x19ecc8 | out: ppvObject=0x19ecc8*=0x72fb38) returned 0x0 [0088.036] SetErrorInfo (dwReserved=0x0, perrinfo=0x72fb38) returned 0x0 [0088.036] IUnknown:Release (This=0x72fb38) returned 0x2 [0088.036] IUnknown:Release (This=0x72fb3c) returned 0x1 [0088.037] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x19fb0c | out: pperrinfo=0x19fb0c*=0x72fb38) returned 0x0 [0088.037] IErrorInfo:GetSource (in: This=0x72fb38, pBstrSource=0x28b14dc | out: pBstrSource=0x28b14dc*="ExtendeRTF") returned 0x0 [0088.037] IErrorInfo:GetDescription (in: This=0x72fb38, pBstrDescription=0x28b14e0 | out: pBstrDescription=0x28b14e0*="Application-defined or object-defined error") returned 0x0 [0088.037] IErrorInfo:GetHelpFile (in: This=0x72fb38, pBstrHelpFile=0x28b14e4 | out: pBstrHelpFile=0x28b14e4*=0x0) returned 0x0 [0088.037] IErrorInfo:GetHelpContext (in: This=0x72fb38, pdwHelpContext=0x28b14e8 | out: pdwHelpContext=0x28b14e8*=0xf429f) returned 0x0 [0088.037] IUnknown:Release (This=0x72fb38) returned 0x0 [0088.037] GetCurrentThreadId () returned 0xa7c [0088.038] GetCurrentThreadId () returned 0xa7c [0088.038] GetCurrentThreadId () returned 0xa7c [0088.038] lstrcmpiA (lpString1="MSFlexGridLib.MSFlexGrid", lpString2="MSFlexGridLib.MSFlexGrid") returned 0 [0088.038] lstrcmpiA (lpString1="MSComDlg.CommonDialog", lpString2="MSComDlg.CommonDialog") returned 0 [0088.038] lstrcmpiA (lpString1="MSComctlLib.TabStrip", lpString2="MSComctlLib.TabStrip") returned 0 [0088.038] lstrcmpiA (lpString1="MSComctlLib.Toolbar", lpString2="MSComctlLib.Toolbar") returned 0 [0088.038] lstrcmpiA (lpString1="MSComctlLib.StatusBar", lpString2="MSComctlLib.StatusBar") returned 0 [0088.038] lstrcmpiA (lpString1="MSComctlLib.ProgressBar", lpString2="MSComctlLib.ProgressBar") returned 0 [0088.038] lstrcmpiA (lpString1="MSComctlLib.TreeView", lpString2="MSComctlLib.TreeView") returned 0 [0088.039] lstrcmpiA (lpString1="MSComctlLib.ListView", lpString2="MSComctlLib.ListView") returned 0 [0088.039] lstrcmpiA (lpString1="VB.Form", lpString2="MSComctlLib.ImageList") returned 1 [0088.039] lstrcmpiA (lpString1="MSComctlLib.ImageList", lpString2="MSComctlLib.ImageList") returned 0 [0088.039] lstrcmpiA (lpString1="MSComctlLib.Slider", lpString2="MSComctlLib.Slider") returned 0 [0088.039] lstrcmpiA (lpString1="MSComctlLib.ImageCombo", lpString2="MSComctlLib.ImageCombo") returned 0 [0088.039] lstrcmpiA (lpString1="MSComCtl2.Animation", lpString2="MSComCtl2.Animation") returned 0 [0088.039] lstrcmpiA (lpString1="MSComCtl2.UpDown", lpString2="MSComCtl2.UpDown") returned 0 [0088.039] lstrcmpiA (lpString1="MSComCtl2.MonthView", lpString2="MSComCtl2.MonthView") returned 0 [0088.039] lstrcmpiA (lpString1="MSComCtl2.DTPicker", lpString2="MSComCtl2.DTPicker") returned 0 [0088.039] lstrcmpiA (lpString1="VB.Form", lpString2="MSComCtl2.FlatScrollBar") returned 1 [0088.039] lstrcmpiA (lpString1="MSComctlLib.ImageList", lpString2="MSComCtl2.FlatScrollBar") returned 1 [0088.039] lstrcmpiA (lpString1="MSComCtl2.FlatScrollBar", lpString2="MSComCtl2.FlatScrollBar") returned 0 [0088.039] lstrcmpiA (lpString1="VB.CommandButton", lpString2="InetCtlsObjects.Inet") returned 1 [0088.040] lstrcmpiA (lpString1="InetCtlsObjects.Inet", lpString2="InetCtlsObjects.Inet") returned 0 [0088.040] lstrcmpiA (lpString1="RichTextLib.RichTextBox", lpString2="RichTextLib.RichTextBox") returned 0 [0088.040] lstrcmpiA (lpString1="MSChart20Lib.MSChart", lpString2="MSChart20Lib.MSChart") returned 0 [0088.040] lstrcmpiA (lpString1="MSFlexGridLib.MSFlexGrid", lpString2="MSWinsockLib.Winsock") returned -1 [0088.040] lstrcmpiA (lpString1="MSWinsockLib.Winsock", lpString2="MSWinsockLib.Winsock") returned 0 [0088.040] lstrcmpiA (lpString1="MSMAPI.MAPISession", lpString2="MSMAPI.MAPISession") returned 0 [0088.040] lstrcmpiA (lpString1="MSMAPI.MAPISession", lpString2="MSMAPI.MAPIMessages") returned 1 [0088.040] lstrcmpiA (lpString1="MSMAPI.MAPIMessages", lpString2="MSMAPI.MAPIMessages") returned 0 [0088.040] lstrcmpiA (lpString1="MCI.MMControl", lpString2="MCI.MMControl") returned 0 [0088.040] lstrcmpiA (lpString1="PicClip.PictureClip", lpString2="PicClip.PictureClip") returned 0 [0088.040] lstrcmpiA (lpString1="VB.Form", lpString2="MSCommLib.MSComm") returned 1 [0088.040] lstrcmpiA (lpString1="MSComctlLib.ImageList", lpString2="MSCommLib.MSComm") returned -1 [0088.040] lstrcmpiA (lpString1="MSComCtl2.FlatScrollBar", lpString2="MSCommLib.MSComm") returned -1 [0088.040] lstrcmpiA (lpString1="MSCommLib.MSComm", lpString2="MSCommLib.MSComm") returned 0 [0088.041] lstrcmpiA (lpString1="MSMask.MaskEdBox", lpString2="MSMask.MaskEdBox") returned 0 [0088.041] lstrcmpiA (lpString1="VB.MDIForm", lpString2="MSDataGridLib.DataGrid") returned 1 [0088.041] lstrcmpiA (lpString1="VB.PropertyPage", lpString2="MSDataGridLib.DataGrid") returned 1 [0088.041] lstrcmpiA (lpString1="MSDataGridLib.DataGrid", lpString2="MSDataGridLib.DataGrid") returned 0 [0088.041] lstrcmpiA (lpString1="MSDataListLib.DataList", lpString2="MSDataListLib.DataList") returned 0 [0088.041] lstrcmpiA (lpString1="MSDataListLib.DataCombo", lpString2="MSDataListLib.DataCombo") returned 0 [0088.041] lstrcmpiA (lpString1="ComCtl3.CoolBar", lpString2="ComCtl3.CoolBar") returned 0 [0088.041] lstrcmpiA (lpString1="VB.CommandButton", lpString2="MSHierarchicalFlexGridLib.MSHFlexGrid") returned 1 [0088.041] lstrcmpiA (lpString1="InetCtlsObjects.Inet", lpString2="MSHierarchicalFlexGridLib.MSHFlexGrid") returned -1 [0088.041] lstrcmpiA (lpString1="MSHierarchicalFlexGridLib.MSHFlexGrid", lpString2="MSHierarchicalFlexGridLib.MSHFlexGrid") returned 0 [0088.042] lstrcmpiA (lpString1="AnimatedGIF.DXAnimatedGIF", lpString2="AnimatedGIF.DXAnimatedGIF") returned 0 [0088.042] lstrcmpiA (lpString1="MSComctlLib.Toolbar", lpString2="Boton2007.Boton") returned 1 [0088.042] lstrcmpiA (lpString1="Boton2007.Boton", lpString2="Boton2007.Boton") returned 0 [0088.042] lstrcmpiA (lpString1="MSComctlLib.TreeView", lpString2="Proyecto1.ButtonOffice") returned -1 [0088.042] lstrcmpiA (lpString1="Proyecto1.ButtonOffice", lpString2="Proyecto1.ButtonOffice") returned 0 [0088.042] IMalloc:Free (This=0x75638d00, pv=0x7489e0) [0088.043] CoDisconnectObject (pUnk=0x718360, dwReserved=0x0) returned 0x0 [0088.043] IUnknown:QueryInterface (in: This=0x718360, riid=0x754c73c0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19fa20 | out: ppvObject=0x19fa20*=0x0) returned 0x80004002 [0088.043] IUnknown:QueryInterface (in: This=0x718360, riid=0x754c7410*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19fa1c | out: ppvObject=0x19fa1c*=0x71837c) returned 0x0 [0088.044] IUnknown:Release (This=0x71837c) returned 0x3 [0088.044] IMalloc:Free (This=0x75638d00, pv=0x715fb0) [0088.044] GetCurrentThreadId () returned 0xa7c [0088.044] GetCurrentThreadId () returned 0xa7c [0088.044] PostMessageA (hWnd=0x602d2, Msg=0x0, wParam=0x0, lParam=0x0) returned 1 [0088.061] GetCurrentThreadId () returned 0xa7c [0088.061] GetCurrentThreadId () returned 0xa7c [0088.061] GetCurrentThreadId () returned 0xa7c [0088.061] GetCurrentThreadId () returned 0xa7c [0088.061] GetCurrentThreadId () returned 0xa7c [0088.061] GetCurrentThreadId () returned 0xa7c [0088.061] PostMessageA (hWnd=0x602d2, Msg=0x0, wParam=0x0, lParam=0x0) returned 1 [0088.062] FreeLibrary (hLibModule=0x74650000) returned 1 [0088.064] FreeLibrary (hLibModule=0x74790000) returned 1 [0088.065] GetCurrentThreadId () returned 0xa7c [0088.065] SendMessageA (hWnd=0x602d2, Msg=0x1061, wParam=0x0, lParam=0x0) returned 0x0 [0088.065] GetCurrentThreadId () returned 0xa7c [0088.065] GetCapture () returned 0x0 [0088.065] ShowWindow (hWnd=0x501f6, nCmdShow=0) returned 0 [0088.065] IsChild (hWndParent=0x2036e, hWnd=0x401e8) returned 0 [0088.065] GetWindow (hWnd=0x2036e, uCmd=0x5) returned 0x0 [0088.065] GetFocus () returned 0x0 [0088.065] DestroyWindow (hWnd=0x2036e) returned 1 [0088.066] NtdllDefWindowProc_A (hWnd=0x2036e, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0088.066] NtdllDefWindowProc_A (hWnd=0x2036e, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0 [0088.066] NtdllDefWindowProc_A (hWnd=0x2036e, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0088.067] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f1fad0 | out: hHeap=0x28b0000) returned 1 [0088.067] IsChild (hWndParent=0x501ec, hWnd=0x401e8) returned 0 [0088.067] GetWindow (hWnd=0x501ec, uCmd=0x5) returned 0x0 [0088.067] GetFocus () returned 0x0 [0088.067] DestroyWindow (hWnd=0x501ec) returned 1 [0088.068] NtdllDefWindowProc_A (hWnd=0x501ec, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0088.068] NtdllDefWindowProc_A (hWnd=0x501ec, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0 [0088.068] NtdllDefWindowProc_A (hWnd=0x501ec, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0088.069] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f1fbb8 | out: hHeap=0x28b0000) returned 1 [0088.069] IsChild (hWndParent=0x501f6, hWnd=0x401e8) returned 0 [0088.069] GetWindow (hWnd=0x501f6, uCmd=0x5) returned 0x402d8 [0088.069] GetWindow (hWnd=0x402d8, uCmd=0x2) returned 0x0 [0088.069] DestroyWindow (hWnd=0x501f6) returned 1 [0088.069] DefFrameProcA (hWnd=0x501f6, hWndMDIClient=0x402d8, uMsg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0088.070] SendMessageA (hWnd=0x501f6, Msg=0x80, wParam=0x0, lParam=0x0) returned 0x0 [0088.070] DefFrameProcA (hWnd=0x501f6, hWndMDIClient=0x402d8, uMsg=0x80, wParam=0x0, lParam=0x0) returned 0x0 [0088.074] DefFrameProcA (hWnd=0x501f6, hWndMDIClient=0x402d8, uMsg=0x2, wParam=0x0, lParam=0x0) returned 0x0 [0088.074] GetParent (hWnd=0x402d8) returned 0x501f6 [0088.074] CallWindowProcA (lpPrevWndFunc=0x747b0e80, hWnd=0x402d8, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0 [0088.075] GetParent (hWnd=0x402d8) returned 0x501f6 [0088.075] CallWindowProcA (lpPrevWndFunc=0x747b0e80, hWnd=0x402d8, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0088.075] CFontEventsCP::Unadvise () returned 0x0 [0088.075] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f1b788 | out: hHeap=0x28b0000) returned 1 [0088.076] CFontEventsCP::Release () returned 0x0 [0088.076] CPicture::Release () returned 0x0 [0088.076] CPicture::Release () returned 0x1 [0088.076] DefFrameProcA (hWnd=0x501f6, hWndMDIClient=0x402d8, uMsg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0088.077] DestroyMenu (hMenu=0x60267) returned 1 [0088.078] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f1b818 | out: hHeap=0x28b0000) returned 1 [0088.078] GetFocus () returned 0x0 [0088.078] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f1b830 | out: hHeap=0x28b0000) returned 1 [0088.078] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f1f920 | out: hHeap=0x28b0000) returned 1 [0088.078] GetCurrentThreadId () returned 0xa7c [0088.078] PeekMessageA (in: lpMsg=0x19fc28, hWnd=0x602d2, wMsgFilterMin=0x1047, wMsgFilterMax=0x1047, wRemoveMsg=0x0 | out: lpMsg=0x19fc28) returned 0 [0088.078] PostMessageA (hWnd=0x602d2, Msg=0x1047, wParam=0x0, lParam=0x0) returned 1 [0088.078] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f1f458 | out: hHeap=0x28b0000) returned 1 [0088.078] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f1f348 | out: hHeap=0x28b0000) returned 1 [0088.078] IMalloc:Free (This=0x75638d00, pv=0x718360) [0088.078] NtdllDefWindowProc_A (hWnd=0x602d2, Msg=0x1061, wParam=0x0, lParam=0x0) returned 0x0 [0088.079] SendMessageA (hWnd=0x602d2, Msg=0x1050, wParam=0x0, lParam=0x0) returned 0x0 [0088.079] GetCurrentThreadId () returned 0xa7c [0088.079] GetCurrentThreadId () returned 0xa7c [0088.079] GetCurrentThreadId () returned 0xa7c [0088.079] GetCurrentThreadId () returned 0xa7c [0088.079] GetCurrentThreadId () returned 0xa7c [0088.079] GetCurrentThreadId () returned 0xa7c [0088.079] GetCurrentThreadId () returned 0xa7c [0088.079] GetCurrentThreadId () returned 0xa7c [0088.079] GetCurrentThreadId () returned 0xa7c [0088.079] GetCurrentThreadId () returned 0xa7c [0088.079] GetCurrentThreadId () returned 0xa7c [0088.079] GetCurrentThreadId () returned 0xa7c [0088.079] GetCurrentThreadId () returned 0xa7c [0088.079] GetCurrentThreadId () returned 0xa7c [0088.080] GetCurrentThreadId () returned 0xa7c [0088.080] GetCurrentThreadId () returned 0xa7c [0088.080] GetCurrentThreadId () returned 0xa7c [0088.080] GetCurrentThreadId () returned 0xa7c [0088.080] GetCurrentThreadId () returned 0xa7c [0088.080] GetCurrentThreadId () returned 0xa7c [0088.080] GetCurrentThreadId () returned 0xa7c [0088.080] GetCurrentThreadId () returned 0xa7c [0088.080] lstrcpyA (in: lpString1=0x19fa00, lpString2="" | out: lpString1="") returned="" [0088.080] lstrlenA (lpString="") returned 0 [0088.080] lstrcpyA (in: lpString1=0x19f7f8, lpString2="" | out: lpString1="") returned="" [0088.080] lstrcpynA (in: lpString1=0x19f3d0, lpString2="", iMaxLength=260 | out: lpString1="") returned="" [0088.080] lstrlenA (lpString="") returned 0 [0088.081] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x1) returned 0x28bd140 [0088.081] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x1) returned 0x1f16d10 [0088.081] lstrcpyA (in: lpString1=0x28bd140, lpString2="" | out: lpString1="") returned="" [0088.081] lstrlenA (lpString="") returned 0 [0088.081] lstrlenA (lpString=".HLP") returned 4 [0088.081] lstrcpyA (in: lpString1=0x19f4ec, lpString2="" | out: lpString1="") returned="" [0088.081] lstrcatA (in: lpString1="", lpString2=".HLP" | out: lpString1=".HLP") returned=".HLP" [0088.081] lstrcpynA (in: lpString1=0x19f2b0, lpString2=".HLP", iMaxLength=260 | out: lpString1=".HLP") returned=".HLP" [0088.081] lstrlenA (lpString=".HLP") returned 4 [0088.081] RtlReAllocateHeap (Heap=0x28b0000, Flags=0x0, Ptr=0x28bd140, Size=0x5) returned 0x28bd140 [0088.081] RtlReAllocateHeap (Heap=0x28b0000, Flags=0x0, Ptr=0x1f16d10, Size=0x5) returned 0x1f16d10 [0088.081] lstrcpyA (in: lpString1=0x28bd140, lpString2=".HLP" | out: lpString1=".HLP") returned=".HLP" [0088.081] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x105) returned 0x1f1f348 [0088.081] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x5) returned 0x1f16d20 [0088.081] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows", ulOptions=0x0, samDesired=0x20019, phkResult=0x19f3a0 | out: phkResult=0x19f3a0*=0x228) returned 0x0 [0088.081] RegOpenKeyExA (in: hKey=0x228, lpSubKey="HTML Help", ulOptions=0x0, samDesired=0x20019, phkResult=0x19f3a4 | out: phkResult=0x19f3a4*=0x224) returned 0x0 [0088.081] RegQueryValueExA (in: hKey=0x224, lpValueName=".HLP", lpReserved=0x0, lpType=0x0, lpData=0x1f1f348, lpcbData=0x19f39c*=0x104 | out: lpType=0x0, lpData=0x1f1f348*=0xa8, lpcbData=0x19f39c*=0x104) returned 0x2 [0088.081] RegCloseKey (hKey=0x224) returned 0x0 [0088.081] RegCloseKey (hKey=0x228) returned 0x0 [0088.082] GetPrivateProfileStringA (in: lpAppName="FILES", lpKeyName=".HLP", lpDefault="", lpReturnedString=0x1f1f348, nSize=0x104, lpFileName="WINHELP.INI" | out: lpReturnedString="") returned 0x0 [0088.082] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f1f348 | out: hHeap=0x28b0000) returned 1 [0088.082] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f16d20 | out: hHeap=0x28b0000) returned 1 [0088.082] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x105) returned 0x1f1f348 [0088.082] RtlAllocateHeap (HeapHandle=0x28b0000, Flags=0x0, Size=0x5) returned 0x1f16d20 [0088.083] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows", ulOptions=0x0, samDesired=0x20019, phkResult=0x19f3a0 | out: phkResult=0x19f3a0*=0x228) returned 0x0 [0088.083] RegOpenKeyExA (in: hKey=0x228, lpSubKey="Help", ulOptions=0x0, samDesired=0x20019, phkResult=0x19f3a4 | out: phkResult=0x19f3a4*=0x0) returned 0x2 [0088.083] RegCloseKey (hKey=0x228) returned 0x0 [0088.083] GetPrivateProfileStringA (in: lpAppName="FILES", lpKeyName=".HLP", lpDefault="", lpReturnedString=0x1f1f348, nSize=0x104, lpFileName="WINHELP.INI" | out: lpReturnedString="") returned 0x0 [0088.083] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f1f348 | out: hHeap=0x28b0000) returned 1 [0088.083] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f16d20 | out: hHeap=0x28b0000) returned 1 [0088.083] lstrcpynA (in: lpString1=0x19f2a4, lpString2="C:\\Windows\\SYSTEM32", iMaxLength=260 | out: lpString1="C:\\Windows\\SYSTEM32") returned="C:\\Windows\\SYSTEM32" [0088.083] lstrlenA (lpString="C:\\Windows\\SYSTEM32") returned 19 [0088.083] RtlReAllocateHeap (Heap=0x28b0000, Flags=0x0, Ptr=0x28bd140, Size=0x14) returned 0x1f16d20 [0088.083] lstrlenA (lpString="C:\\Windows\\SYSTEM32") returned 19 [0088.083] RtlReAllocateHeap (Heap=0x28b0000, Flags=0x0, Ptr=0x1f16d10, Size=0x14) returned 0x1f123c8 [0088.083] lstrcpyA (in: lpString1=0x1f16d20, lpString2="C:\\Windows\\SYSTEM32" | out: lpString1="C:\\Windows\\SYSTEM32") returned="C:\\Windows\\SYSTEM32" [0088.083] lstrcpynA (in: lpString1=0x19f2ac, lpString2=".HLP", iMaxLength=260 | out: lpString1=".HLP") returned=".HLP" [0088.083] lstrlenA (lpString=".HLP") returned 4 [0088.083] lstrlenA (lpString="C:\\Windows\\SYSTEM32") returned 19 [0088.083] RtlReAllocateHeap (Heap=0x28b0000, Flags=0x0, Ptr=0x1f16d20, Size=0x19) returned 0x1f1f348 [0088.083] lstrlenA (lpString="C:\\Windows\\SYSTEM32") returned 19 [0088.083] RtlReAllocateHeap (Heap=0x28b0000, Flags=0x0, Ptr=0x1f123c8, Size=0x19) returned 0x1f123c8 [0088.083] lstrcatA (in: lpString1="C:\\Windows\\SYSTEM32", lpString2="\\" | out: lpString1="C:\\Windows\\SYSTEM32\\") returned="C:\\Windows\\SYSTEM32\\" [0088.084] lstrcatA (in: lpString1="C:\\Windows\\SYSTEM32\\", lpString2=".HLP" | out: lpString1="C:\\Windows\\SYSTEM32\\.HLP") returned="C:\\Windows\\SYSTEM32\\.HLP" [0088.084] lstrlenA (lpString="C:\\Windows\\SYSTEM32\\.HLP") returned 24 [0088.084] CharToOemBuffA (in: lpszSrc="C:\\Windows\\SYSTEM32\\.HLP", lpszDst=0x19f2b0, cchDstLength=0x19 | out: lpszDst="C:\\Windows\\SYSTEM32\\.HLP") returned 1 [0088.084] GetFileAttributesA (lpFileName="C:\\Windows\\SYSTEM32\\.HLP" (normalized: "c:\\windows\\syswow64\\.hlp")) returned 0xffffffff [0088.084] GetLastError () returned 0x2 [0088.084] GetLastError () returned 0x2 [0088.084] SetLastError (dwErrCode=0x2) [0088.084] GetLastError () returned 0x2 [0088.084] SetLastError (dwErrCode=0x2) [0088.084] GetFileAttributesA (lpFileName="C:\\Windows\\SYSTEM32\\.HLP" (normalized: "c:\\windows\\syswow64\\.hlp")) returned 0xffffffff [0088.084] GetLastError () returned 0x2 [0088.084] GetLastError () returned 0x2 [0088.084] SetLastError (dwErrCode=0x2) [0088.084] GetLastError () returned 0x2 [0088.084] SetLastError (dwErrCode=0x2) [0088.084] GetWindowsDirectoryA (in: lpBuffer=0x19f3cc, uSize=0x104 | out: lpBuffer="C:\\Windows") returned 0xa [0088.084] lstrlenA (lpString="C:\\Windows") returned 10 [0088.084] lstrlenA (lpString="C:\\Windows") returned 10 [0088.084] lstrlenA (lpString="C:\\Windows\\") returned 11 [0088.084] lstrcpynA (in: lpString1=0x19f2b0, lpString2="C:\\Windows\\Help", iMaxLength=260 | out: lpString1="C:\\Windows\\Help") returned="C:\\Windows\\Help" [0088.084] lstrlenA (lpString="C:\\Windows\\Help") returned 15 [0088.084] RtlReAllocateHeap (Heap=0x28b0000, Flags=0x0, Ptr=0x1f1f348, Size=0x10) returned 0x1f1f348 [0088.084] lstrlenA (lpString="C:\\Windows\\Help") returned 15 [0088.085] RtlReAllocateHeap (Heap=0x28b0000, Flags=0x0, Ptr=0x1f123c8, Size=0x10) returned 0x1f123c8 [0088.085] lstrcpyA (in: lpString1=0x1f1f348, lpString2="C:\\Windows\\Help" | out: lpString1="C:\\Windows\\Help") returned="C:\\Windows\\Help" [0088.085] lstrcpynA (in: lpString1=0x19f2ac, lpString2=".HLP", iMaxLength=260 | out: lpString1=".HLP") returned=".HLP" [0088.085] lstrlenA (lpString=".HLP") returned 4 [0088.085] lstrlenA (lpString="C:\\Windows\\Help") returned 15 [0088.085] RtlReAllocateHeap (Heap=0x28b0000, Flags=0x0, Ptr=0x1f1f348, Size=0x15) returned 0x1f1f348 [0088.085] lstrlenA (lpString="C:\\Windows\\Help") returned 15 [0088.085] RtlReAllocateHeap (Heap=0x28b0000, Flags=0x0, Ptr=0x1f123c8, Size=0x15) returned 0x1f123c8 [0088.085] lstrcatA (in: lpString1="C:\\Windows\\Help", lpString2="\\" | out: lpString1="C:\\Windows\\Help\\") returned="C:\\Windows\\Help\\" [0088.085] lstrcatA (in: lpString1="C:\\Windows\\Help\\", lpString2=".HLP" | out: lpString1="C:\\Windows\\Help\\.HLP") returned="C:\\Windows\\Help\\.HLP" [0088.085] lstrlenA (lpString="C:\\Windows\\Help\\.HLP") returned 20 [0088.085] CharToOemBuffA (in: lpszSrc="C:\\Windows\\Help\\.HLP", lpszDst=0x19f2b0, cchDstLength=0x15 | out: lpszDst="C:\\Windows\\Help\\.HLP") returned 1 [0088.085] GetFileAttributesA (lpFileName="C:\\Windows\\Help\\.HLP" (normalized: "c:\\windows\\help\\.hlp")) returned 0xffffffff [0088.085] GetLastError () returned 0x2 [0088.085] GetLastError () returned 0x2 [0088.085] SetLastError (dwErrCode=0x2) [0088.085] GetLastError () returned 0x2 [0088.085] SetLastError (dwErrCode=0x2) [0088.085] GetFileAttributesA (lpFileName="C:\\Windows\\Help\\.HLP" (normalized: "c:\\windows\\help\\.hlp")) returned 0xffffffff [0088.085] GetLastError () returned 0x2 [0088.085] GetLastError () returned 0x2 [0088.086] SetLastError (dwErrCode=0x2) [0088.086] GetLastError () returned 0x2 [0088.086] SetLastError (dwErrCode=0x2) [0088.086] lstrlenA (lpString="") returned 0 [0088.086] lstrcpyA (in: lpString1=0x19f2c0, lpString2="" | out: lpString1="") returned="" [0088.086] lstrlenA (lpString=".HLP") returned 4 [0088.086] lstrlenA (lpString="") returned 0 [0088.086] lstrcpynA (in: lpString1=0x19f3d0, lpString2="", iMaxLength=260 | out: lpString1="") returned="" [0088.086] lstrlenA (lpString="") returned 0 [0088.086] RtlReAllocateHeap (Heap=0x28b0000, Flags=0x0, Ptr=0x1f1f348, Size=0x1) returned 0x1f1f348 [0088.086] RtlReAllocateHeap (Heap=0x28b0000, Flags=0x0, Ptr=0x1f123c8, Size=0x1) returned 0x1f123c8 [0088.086] lstrcpyA (in: lpString1=0x1f1f348, lpString2="" | out: lpString1="") returned="" [0088.086] lstrcpyA (in: lpString1=0x19fa00, lpString2="" | out: lpString1="") returned="" [0088.086] lstrlenA (lpString="") returned 0 [0088.086] lstrlenA (lpString="") returned 0 [0088.086] lstrcatA (in: lpString1="", lpString2="" | out: lpString1="") returned="" [0088.086] GetDesktopWindow () returned 0x10010 [0088.086] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f123c8 | out: hHeap=0x28b0000) returned 1 [0088.087] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f1f348 | out: hHeap=0x28b0000) returned 1 [0088.087] CoFreeUnusedLibraries () [0088.529] GetCurrentThreadId () returned 0xa7c [0088.529] DestroyWindow (hWnd=0x602d2) returned 1 [0088.530] NtdllDefWindowProc_A (hWnd=0x602d2, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0088.530] NtdllDefWindowProc_A (hWnd=0x602d2, Msg=0x46, wParam=0x0, lParam=0x19fc94) returned 0x0 [0088.533] NtdllDefWindowProc_A (hWnd=0x602d2, Msg=0x47, wParam=0x0, lParam=0x19fc94) returned 0x0 [0088.533] NtdllDefWindowProc_A (hWnd=0x602d2, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0 [0088.533] NtdllDefWindowProc_A (hWnd=0x401e8, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0 [0088.534] NtdllDefWindowProc_A (hWnd=0x401e8, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0088.535] PostQuitMessage (nExitCode=0) [0088.535] NtdllDefWindowProc_A (hWnd=0x602d2, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0088.536] NtdllDefWindowProc_A (hWnd=0x602d2, Msg=0x1050, wParam=0x0, lParam=0x0) returned 0x0 [0088.536] GetCurrentThreadId () returned 0xa7c [0088.536] GetCurrentThreadId () returned 0xa7c [0088.537] GetCurrentThreadId () returned 0xa7c [0088.537] GetCurrentThreadId () returned 0xa7c [0088.537] lstrcmpiA (lpString1="MSFlexGridLib.MSFlexGrid", lpString2="MSFlexGridLib.MSFlexGrid") returned 0 [0088.537] lstrcmpiA (lpString1="MSComDlg.CommonDialog", lpString2="MSComDlg.CommonDialog") returned 0 [0088.537] lstrcmpiA (lpString1="MSComctlLib.TabStrip", lpString2="MSComctlLib.TabStrip") returned 0 [0088.538] lstrcmpiA (lpString1="MSComctlLib.Toolbar", lpString2="MSComctlLib.Toolbar") returned 0 [0088.538] lstrcmpiA (lpString1="MSComctlLib.StatusBar", lpString2="MSComctlLib.StatusBar") returned 0 [0088.538] lstrcmpiA (lpString1="MSComctlLib.ProgressBar", lpString2="MSComctlLib.ProgressBar") returned 0 [0088.538] lstrcmpiA (lpString1="MSComctlLib.TreeView", lpString2="MSComctlLib.TreeView") returned 0 [0088.538] lstrcmpiA (lpString1="MSComctlLib.ListView", lpString2="MSComctlLib.ListView") returned 0 [0088.538] lstrcmpiA (lpString1="VB.Form", lpString2="MSComctlLib.ImageList") returned 1 [0088.538] lstrcmpiA (lpString1="MSComctlLib.ImageList", lpString2="MSComctlLib.ImageList") returned 0 [0088.538] lstrcmpiA (lpString1="MSComctlLib.Slider", lpString2="MSComctlLib.Slider") returned 0 [0088.538] lstrcmpiA (lpString1="MSComctlLib.ImageCombo", lpString2="MSComctlLib.ImageCombo") returned 0 [0088.538] lstrcmpiA (lpString1="MSComCtl2.Animation", lpString2="MSComCtl2.Animation") returned 0 [0088.539] lstrcmpiA (lpString1="MSComCtl2.UpDown", lpString2="MSComCtl2.UpDown") returned 0 [0088.539] lstrcmpiA (lpString1="MSComCtl2.MonthView", lpString2="MSComCtl2.MonthView") returned 0 [0088.539] lstrcmpiA (lpString1="MSComCtl2.DTPicker", lpString2="MSComCtl2.DTPicker") returned 0 [0088.539] lstrcmpiA (lpString1="VB.Form", lpString2="MSComCtl2.FlatScrollBar") returned 1 [0088.539] lstrcmpiA (lpString1="MSComctlLib.ImageList", lpString2="MSComCtl2.FlatScrollBar") returned 1 [0088.539] lstrcmpiA (lpString1="MSComCtl2.FlatScrollBar", lpString2="MSComCtl2.FlatScrollBar") returned 0 [0088.539] lstrcmpiA (lpString1="VB.CommandButton", lpString2="InetCtlsObjects.Inet") returned 1 [0088.539] lstrcmpiA (lpString1="InetCtlsObjects.Inet", lpString2="InetCtlsObjects.Inet") returned 0 [0088.539] lstrcmpiA (lpString1="RichTextLib.RichTextBox", lpString2="RichTextLib.RichTextBox") returned 0 [0088.540] lstrcmpiA (lpString1="MSChart20Lib.MSChart", lpString2="MSChart20Lib.MSChart") returned 0 [0088.540] lstrcmpiA (lpString1="MSFlexGridLib.MSFlexGrid", lpString2="MSWinsockLib.Winsock") returned -1 [0088.540] lstrcmpiA (lpString1="MSWinsockLib.Winsock", lpString2="MSWinsockLib.Winsock") returned 0 [0088.540] lstrcmpiA (lpString1="MSMAPI.MAPISession", lpString2="MSMAPI.MAPISession") returned 0 [0088.540] lstrcmpiA (lpString1="MSMAPI.MAPISession", lpString2="MSMAPI.MAPIMessages") returned 1 [0088.540] lstrcmpiA (lpString1="MSMAPI.MAPIMessages", lpString2="MSMAPI.MAPIMessages") returned 0 [0088.540] lstrcmpiA (lpString1="MCI.MMControl", lpString2="MCI.MMControl") returned 0 [0088.540] lstrcmpiA (lpString1="PicClip.PictureClip", lpString2="PicClip.PictureClip") returned 0 [0088.540] lstrcmpiA (lpString1="VB.Form", lpString2="MSCommLib.MSComm") returned 1 [0088.540] lstrcmpiA (lpString1="MSComctlLib.ImageList", lpString2="MSCommLib.MSComm") returned -1 [0088.541] lstrcmpiA (lpString1="MSComCtl2.FlatScrollBar", lpString2="MSCommLib.MSComm") returned -1 [0088.541] lstrcmpiA (lpString1="MSCommLib.MSComm", lpString2="MSCommLib.MSComm") returned 0 [0088.541] lstrcmpiA (lpString1="MSMask.MaskEdBox", lpString2="MSMask.MaskEdBox") returned 0 [0088.541] lstrcmpiA (lpString1="VB.MDIForm", lpString2="MSDataGridLib.DataGrid") returned 1 [0088.541] lstrcmpiA (lpString1="VB.PropertyPage", lpString2="MSDataGridLib.DataGrid") returned 1 [0088.541] lstrcmpiA (lpString1="MSDataGridLib.DataGrid", lpString2="MSDataGridLib.DataGrid") returned 0 [0088.541] lstrcmpiA (lpString1="MSDataListLib.DataList", lpString2="MSDataListLib.DataList") returned 0 [0088.541] lstrcmpiA (lpString1="MSDataListLib.DataCombo", lpString2="MSDataListLib.DataCombo") returned 0 [0088.541] lstrcmpiA (lpString1="ComCtl3.CoolBar", lpString2="ComCtl3.CoolBar") returned 0 [0088.541] lstrcmpiA (lpString1="VB.CommandButton", lpString2="MSHierarchicalFlexGridLib.MSHFlexGrid") returned 1 [0088.541] lstrcmpiA (lpString1="InetCtlsObjects.Inet", lpString2="MSHierarchicalFlexGridLib.MSHFlexGrid") returned -1 [0088.541] lstrcmpiA (lpString1="MSHierarchicalFlexGridLib.MSHFlexGrid", lpString2="MSHierarchicalFlexGridLib.MSHFlexGrid") returned 0 [0088.542] lstrcmpiA (lpString1="AnimatedGIF.DXAnimatedGIF", lpString2="AnimatedGIF.DXAnimatedGIF") returned 0 [0088.542] lstrcmpiA (lpString1="MSComctlLib.Toolbar", lpString2="Boton2007.Boton") returned 1 [0088.542] lstrcmpiA (lpString1="Boton2007.Boton", lpString2="Boton2007.Boton") returned 0 [0088.542] lstrcmpiA (lpString1="MSComctlLib.TreeView", lpString2="Proyecto1.ButtonOffice") returned -1 [0088.542] lstrcmpiA (lpString1="Proyecto1.ButtonOffice", lpString2="Proyecto1.ButtonOffice") returned 0 [0088.542] GetCurrentThreadId () returned 0xa7c [0088.542] GetCurrentThreadId () returned 0xa7c [0088.542] GetCurrentThreadId () returned 0xa7c [0088.543] GetCurrentThreadId () returned 0xa7c [0088.543] GetCurrentThreadId () returned 0xa7c [0088.543] GetCurrentThreadId () returned 0xa7c [0088.543] GetCurrentThreadId () returned 0xa7c [0088.543] GetCurrentThreadId () returned 0xa7c [0088.543] PostMessageA (hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 1 [0088.546] GetCurrentThreadId () returned 0xa7c [0088.547] GetCurrentThreadId () returned 0xa7c [0088.547] GetCurrentThreadId () returned 0xa7c [0088.547] GetCurrentThreadId () returned 0xa7c [0088.547] GetCurrentThreadId () returned 0xa7c [0088.547] GetCurrentThreadId () returned 0xa7c [0088.547] GetCurrentThreadId () returned 0xa7c [0088.547] GetCurrentThreadId () returned 0xa7c [0088.547] GetCurrentThreadId () returned 0xa7c [0088.547] GetCurrentThreadId () returned 0xa7c [0088.547] GetCurrentThreadId () returned 0xa7c [0088.547] GetCurrentThreadId () returned 0xa7c [0088.547] GetCurrentThreadId () returned 0xa7c [0088.547] GetCurrentThreadId () returned 0xa7c [0088.550] GetCurrentThreadId () returned 0xa7c [0088.550] GetCurrentThreadId () returned 0xa7c [0088.550] GetCurrentThreadId () returned 0xa7c [0088.550] GetCurrentThreadId () returned 0xa7c [0088.550] GetCurrentThreadId () returned 0xa7c [0088.550] GetCurrentThreadId () returned 0xa7c [0088.550] GetCurrentThreadId () returned 0xa7c [0088.550] GetCurrentThreadId () returned 0xa7c [0088.550] GetCurrentThreadId () returned 0xa7c [0088.550] GetCurrentThreadId () returned 0xa7c [0088.550] GetCurrentThreadId () returned 0xa7c [0088.551] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f1b6f8 | out: hHeap=0x28b0000) returned 1 [0088.551] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28bd130 | out: hHeap=0x28b0000) returned 1 [0088.551] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f1b7a0 | out: hHeap=0x28b0000) returned 1 [0088.551] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f1b6b0 | out: hHeap=0x28b0000) returned 1 [0088.551] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f1fca0 | out: hHeap=0x28b0000) returned 1 [0088.551] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f1cf50 | out: hHeap=0x28b0000) returned 1 [0088.551] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f1c660 | out: hHeap=0x28b0000) returned 1 [0088.551] GetCurrentThreadId () returned 0xa7c [0088.551] GetCurrentThreadId () returned 0xa7c [0088.551] GetCurrentThreadId () returned 0xa7c [0088.551] lstrcmpiA (lpString1="MSFlexGridLib.MSFlexGrid", lpString2="MSFlexGridLib.MSFlexGrid") returned 0 [0088.552] lstrcmpiA (lpString1="MSComDlg.CommonDialog", lpString2="MSComDlg.CommonDialog") returned 0 [0088.552] lstrcmpiA (lpString1="MSComctlLib.TabStrip", lpString2="MSComctlLib.TabStrip") returned 0 [0088.552] lstrcmpiA (lpString1="MSComctlLib.Toolbar", lpString2="MSComctlLib.Toolbar") returned 0 [0088.552] lstrcmpiA (lpString1="MSComctlLib.StatusBar", lpString2="MSComctlLib.StatusBar") returned 0 [0088.552] lstrcmpiA (lpString1="MSComctlLib.ProgressBar", lpString2="MSComctlLib.ProgressBar") returned 0 [0088.552] lstrcmpiA (lpString1="MSComctlLib.TreeView", lpString2="MSComctlLib.TreeView") returned 0 [0088.552] lstrcmpiA (lpString1="MSComctlLib.ListView", lpString2="MSComctlLib.ListView") returned 0 [0088.553] lstrcmpiA (lpString1="VB.Form", lpString2="MSComctlLib.ImageList") returned 1 [0088.553] lstrcmpiA (lpString1="MSComctlLib.ImageList", lpString2="MSComctlLib.ImageList") returned 0 [0088.553] lstrcmpiA (lpString1="MSComctlLib.Slider", lpString2="MSComctlLib.Slider") returned 0 [0088.553] lstrcmpiA (lpString1="MSComctlLib.ImageCombo", lpString2="MSComctlLib.ImageCombo") returned 0 [0088.553] lstrcmpiA (lpString1="MSComCtl2.Animation", lpString2="MSComCtl2.Animation") returned 0 [0088.553] lstrcmpiA (lpString1="MSComCtl2.UpDown", lpString2="MSComCtl2.UpDown") returned 0 [0088.553] lstrcmpiA (lpString1="MSComCtl2.MonthView", lpString2="MSComCtl2.MonthView") returned 0 [0088.553] lstrcmpiA (lpString1="MSComCtl2.DTPicker", lpString2="MSComCtl2.DTPicker") returned 0 [0088.554] lstrcmpiA (lpString1="VB.Form", lpString2="MSComCtl2.FlatScrollBar") returned 1 [0088.554] lstrcmpiA (lpString1="MSComctlLib.ImageList", lpString2="MSComCtl2.FlatScrollBar") returned 1 [0088.554] lstrcmpiA (lpString1="MSComCtl2.FlatScrollBar", lpString2="MSComCtl2.FlatScrollBar") returned 0 [0088.554] lstrcmpiA (lpString1="VB.CommandButton", lpString2="InetCtlsObjects.Inet") returned 1 [0088.554] lstrcmpiA (lpString1="InetCtlsObjects.Inet", lpString2="InetCtlsObjects.Inet") returned 0 [0088.633] lstrcmpiA (lpString1="RichTextLib.RichTextBox", lpString2="RichTextLib.RichTextBox") returned 0 [0088.633] lstrcmpiA (lpString1="MSChart20Lib.MSChart", lpString2="MSChart20Lib.MSChart") returned 0 [0088.633] lstrcmpiA (lpString1="MSFlexGridLib.MSFlexGrid", lpString2="MSWinsockLib.Winsock") returned -1 [0088.633] lstrcmpiA (lpString1="MSWinsockLib.Winsock", lpString2="MSWinsockLib.Winsock") returned 0 [0088.633] lstrcmpiA (lpString1="MSMAPI.MAPISession", lpString2="MSMAPI.MAPISession") returned 0 [0088.633] lstrcmpiA (lpString1="MSMAPI.MAPISession", lpString2="MSMAPI.MAPIMessages") returned 1 [0088.633] lstrcmpiA (lpString1="MSMAPI.MAPIMessages", lpString2="MSMAPI.MAPIMessages") returned 0 [0088.633] lstrcmpiA (lpString1="MCI.MMControl", lpString2="MCI.MMControl") returned 0 [0088.633] lstrcmpiA (lpString1="PicClip.PictureClip", lpString2="PicClip.PictureClip") returned 0 [0088.633] lstrcmpiA (lpString1="VB.Form", lpString2="MSCommLib.MSComm") returned 1 [0088.634] lstrcmpiA (lpString1="MSComctlLib.ImageList", lpString2="MSCommLib.MSComm") returned -1 [0088.634] lstrcmpiA (lpString1="MSComCtl2.FlatScrollBar", lpString2="MSCommLib.MSComm") returned -1 [0088.634] lstrcmpiA (lpString1="MSCommLib.MSComm", lpString2="MSCommLib.MSComm") returned 0 [0088.634] lstrcmpiA (lpString1="MSMask.MaskEdBox", lpString2="MSMask.MaskEdBox") returned 0 [0088.634] lstrcmpiA (lpString1="VB.MDIForm", lpString2="MSDataGridLib.DataGrid") returned 1 [0088.634] lstrcmpiA (lpString1="VB.PropertyPage", lpString2="MSDataGridLib.DataGrid") returned 1 [0088.634] lstrcmpiA (lpString1="MSDataGridLib.DataGrid", lpString2="MSDataGridLib.DataGrid") returned 0 [0088.634] lstrcmpiA (lpString1="MSDataListLib.DataList", lpString2="MSDataListLib.DataList") returned 0 [0088.634] lstrcmpiA (lpString1="MSDataListLib.DataCombo", lpString2="MSDataListLib.DataCombo") returned 0 [0088.634] lstrcmpiA (lpString1="ComCtl3.CoolBar", lpString2="ComCtl3.CoolBar") returned 0 [0088.634] lstrcmpiA (lpString1="VB.CommandButton", lpString2="MSHierarchicalFlexGridLib.MSHFlexGrid") returned 1 [0088.634] lstrcmpiA (lpString1="InetCtlsObjects.Inet", lpString2="MSHierarchicalFlexGridLib.MSHFlexGrid") returned -1 [0088.634] lstrcmpiA (lpString1="MSHierarchicalFlexGridLib.MSHFlexGrid", lpString2="MSHierarchicalFlexGridLib.MSHFlexGrid") returned 0 [0088.634] lstrcmpiA (lpString1="AnimatedGIF.DXAnimatedGIF", lpString2="AnimatedGIF.DXAnimatedGIF") returned 0 [0088.635] lstrcmpiA (lpString1="MSComctlLib.Toolbar", lpString2="Boton2007.Boton") returned 1 [0088.635] lstrcmpiA (lpString1="Boton2007.Boton", lpString2="Boton2007.Boton") returned 0 [0088.635] lstrcmpiA (lpString1="MSComctlLib.TreeView", lpString2="Proyecto1.ButtonOffice") returned -1 [0088.635] lstrcmpiA (lpString1="Proyecto1.ButtonOffice", lpString2="Proyecto1.ButtonOffice") returned 0 [0088.635] GetCurrentThreadId () returned 0xa7c [0088.635] GetCurrentThreadId () returned 0xa7c [0088.635] GetCurrentThreadId () returned 0xa7c [0088.635] GetCurrentThreadId () returned 0xa7c [0088.635] GetCurrentThreadId () returned 0xa7c [0088.636] GetCurrentThreadId () returned 0xa7c [0088.636] GetCurrentThreadId () returned 0xa7c [0088.636] GetCurrentThreadId () returned 0xa7c [0088.636] PostMessageA (hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 1 [0088.640] GetCurrentThreadId () returned 0xa7c [0088.640] GetCurrentThreadId () returned 0xa7c [0088.640] GetCurrentThreadId () returned 0xa7c [0088.640] GetCurrentThreadId () returned 0xa7c [0088.640] GetCurrentThreadId () returned 0xa7c [0088.640] GetCurrentThreadId () returned 0xa7c [0088.640] GetCurrentThreadId () returned 0xa7c [0088.640] GetCurrentThreadId () returned 0xa7c [0088.645] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f18f18 | out: hHeap=0x28b0000) returned 1 [0088.645] IMalloc:Free (This=0x75638d00, pv=0x6faa70) [0088.645] IMalloc:Free (This=0x75638d00, pv=0x6fab38) [0088.646] IMalloc:Free (This=0x75638d00, pv=0x72f918) [0088.646] IMalloc:Free (This=0x75638d00, pv=0x748a98) [0088.646] IMalloc:Free (This=0x75638d00, pv=0x717ac0) [0088.646] IMalloc:Free (This=0x75638d00, pv=0x70e918) [0088.647] IMalloc:Free (This=0x75638d00, pv=0x717820) [0088.647] IMalloc:Free (This=0x75638d00, pv=0x7177b0) [0088.647] IMalloc:Free (This=0x75638d00, pv=0x717660) [0088.647] IMalloc:Free (This=0x75638d00, pv=0x7172e0) [0088.647] IMalloc:Free (This=0x75638d00, pv=0x7175f0) [0088.647] IMalloc:Free (This=0x75638d00, pv=0x7173c0) [0088.647] IMalloc:Free (This=0x75638d00, pv=0x7179e0) [0088.647] IMalloc:Free (This=0x75638d00, pv=0x717350) [0088.647] IMalloc:Free (This=0x75638d00, pv=0x717900) [0088.647] IMalloc:Free (This=0x75638d00, pv=0x717970) [0088.647] IMalloc:Free (This=0x75638d00, pv=0x717510) [0088.647] IMalloc:Free (This=0x75638d00, pv=0x7176d0) [0088.647] IMalloc:Free (This=0x75638d00, pv=0x717a50) [0088.647] IMalloc:Free (This=0x75638d00, pv=0x717580) [0088.647] IMalloc:Free (This=0x75638d00, pv=0x717740) [0088.647] IMalloc:Free (This=0x75638d00, pv=0x717248) [0088.647] IMalloc:Free (This=0x75638d00, pv=0x7171d8) [0088.647] IMalloc:Free (This=0x75638d00, pv=0x717168) [0088.647] IMalloc:Free (This=0x75638d00, pv=0x7170f8) [0088.647] IMalloc:Free (This=0x75638d00, pv=0x717088) [0088.647] IMalloc:Free (This=0x75638d00, pv=0x717018) [0088.647] IMalloc:Free (This=0x75638d00, pv=0x716fa8) [0088.647] IMalloc:Free (This=0x75638d00, pv=0x716f38) [0088.647] IMalloc:Free (This=0x75638d00, pv=0x716ec8) [0088.647] IMalloc:Free (This=0x75638d00, pv=0x716e58) [0088.647] IMalloc:Free (This=0x75638d00, pv=0x716de8) [0088.647] IMalloc:Free (This=0x75638d00, pv=0x716d78) [0088.647] GetCurrentThreadId () returned 0xa7c [0088.648] GetCurrentThreadId () returned 0xa7c [0088.648] GetCurrentThreadId () returned 0xa7c [0088.648] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28bb920 | out: hHeap=0x28b0000) returned 1 [0088.648] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f182c0 | out: hHeap=0x28b0000) returned 1 [0088.648] GetCurrentThreadId () returned 0xa7c [0088.648] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f1b848 | out: hHeap=0x28b0000) returned 1 [0088.648] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f14b58 | out: hHeap=0x28b0000) returned 1 [0088.648] GetCurrentThreadId () returned 0xa7c [0088.648] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28bb9c8 | out: hHeap=0x28b0000) returned 1 [0088.648] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f18200 | out: hHeap=0x28b0000) returned 1 [0088.648] GetCurrentThreadId () returned 0xa7c [0088.648] GetCurrentThreadId () returned 0xa7c [0088.648] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28bb9b0 | out: hHeap=0x28b0000) returned 1 [0088.649] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f17e40 | out: hHeap=0x28b0000) returned 1 [0088.649] GetCurrentThreadId () returned 0xa7c [0088.649] GetCurrentThreadId () returned 0xa7c [0088.649] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28bb8c0 | out: hHeap=0x28b0000) returned 1 [0088.649] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f18260 | out: hHeap=0x28b0000) returned 1 [0088.649] GetCurrentThreadId () returned 0xa7c [0088.649] GetCurrentThreadId () returned 0xa7c [0088.649] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28bb908 | out: hHeap=0x28b0000) returned 1 [0088.649] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f18320 | out: hHeap=0x28b0000) returned 1 [0088.649] GetCurrentThreadId () returned 0xa7c [0088.649] GetCurrentThreadId () returned 0xa7c [0088.649] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28bb998 | out: hHeap=0x28b0000) returned 1 [0088.649] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f18140 | out: hHeap=0x28b0000) returned 1 [0088.649] GetCurrentThreadId () returned 0xa7c [0088.649] GetCurrentThreadId () returned 0xa7c [0088.649] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28bb8d8 | out: hHeap=0x28b0000) returned 1 [0088.650] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f17e10 | out: hHeap=0x28b0000) returned 1 [0088.650] GetCurrentThreadId () returned 0xa7c [0088.650] GetCurrentThreadId () returned 0xa7c [0088.650] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b2050 | out: hHeap=0x28b0000) returned 1 [0088.650] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b1fe8 | out: hHeap=0x28b0000) returned 1 [0088.650] GetCurrentThreadId () returned 0xa7c [0088.650] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f16c68 | out: hHeap=0x28b0000) returned 1 [0088.650] HeapFree (in: hHeap=0x2c00000, dwFlags=0x0, lpMem=0x2c006c8 | out: hHeap=0x2c00000) returned 1 [0088.650] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f12320 | out: hHeap=0x28b0000) returned 1 [0088.650] HeapFree (in: hHeap=0x2c00000, dwFlags=0x0, lpMem=0x2c00700 | out: hHeap=0x2c00000) returned 1 [0088.650] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f18528 | out: hHeap=0x28b0000) returned 1 [0088.650] HeapFree (in: hHeap=0x2c00000, dwFlags=0x0, lpMem=0x2c00738 | out: hHeap=0x2c00000) returned 1 [0088.650] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f185d0 | out: hHeap=0x28b0000) returned 1 [0088.650] HeapFree (in: hHeap=0x2c00000, dwFlags=0x0, lpMem=0x2c00770 | out: hHeap=0x2c00000) returned 1 [0088.650] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f18678 | out: hHeap=0x28b0000) returned 1 [0088.651] HeapFree (in: hHeap=0x2c00000, dwFlags=0x0, lpMem=0x2c007a8 | out: hHeap=0x2c00000) returned 1 [0088.651] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f137d8 | out: hHeap=0x28b0000) returned 1 [0088.651] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f13818 | out: hHeap=0x28b0000) returned 1 [0088.651] SetEvent (hEvent=0x130) returned 1 [0088.651] CloseHandle (hObject=0x130) returned 1 [0088.651] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f1f4e0 | out: hHeap=0x28b0000) returned 1 [0088.651] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f18720 | out: hHeap=0x28b0000) returned 1 [0088.651] HeapFree (in: hHeap=0x2c00000, dwFlags=0x0, lpMem=0x2c007e0 | out: hHeap=0x2c00000) returned 1 [0088.651] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f187c8 | out: hHeap=0x28b0000) returned 1 [0088.651] HeapFree (in: hHeap=0x2c00000, dwFlags=0x0, lpMem=0x2c00818 | out: hHeap=0x2c00000) returned 1 [0088.651] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b2aa0 | out: hHeap=0x28b0000) returned 1 [0088.651] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b2c18 | out: hHeap=0x28b0000) returned 1 [0088.651] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b2c88 | out: hHeap=0x28b0000) returned 1 [0088.651] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b2a88 | out: hHeap=0x28b0000) returned 1 [0088.652] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b2968 | out: hHeap=0x28b0000) returned 1 [0088.652] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b3150 | out: hHeap=0x28b0000) returned 1 [0088.652] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b3248 | out: hHeap=0x28b0000) returned 1 [0088.652] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b3110 | out: hHeap=0x28b0000) returned 1 [0088.652] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b3298 | out: hHeap=0x28b0000) returned 1 [0088.652] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b30f8 | out: hHeap=0x28b0000) returned 1 [0088.652] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b2fd8 | out: hHeap=0x28b0000) returned 1 [0088.652] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b3630 | out: hHeap=0x28b0000) returned 1 [0088.652] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b3758 | out: hHeap=0x28b0000) returned 1 [0088.652] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b35f0 | out: hHeap=0x28b0000) returned 1 [0088.652] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b37c0 | out: hHeap=0x28b0000) returned 1 [0088.652] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b35d8 | out: hHeap=0x28b0000) returned 1 [0088.652] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b34b8 | out: hHeap=0x28b0000) returned 1 [0088.652] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b3ba0 | out: hHeap=0x28b0000) returned 1 [0088.653] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b3c58 | out: hHeap=0x28b0000) returned 1 [0088.653] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b3b70 | out: hHeap=0x28b0000) returned 1 [0088.653] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b3c98 | out: hHeap=0x28b0000) returned 1 [0088.653] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b3b58 | out: hHeap=0x28b0000) returned 1 [0088.653] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b3a38 | out: hHeap=0x28b0000) returned 1 [0088.653] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b3fb8 | out: hHeap=0x28b0000) returned 1 [0088.653] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b4098 | out: hHeap=0x28b0000) returned 1 [0088.653] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b3f88 | out: hHeap=0x28b0000) returned 1 [0088.653] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b40e8 | out: hHeap=0x28b0000) returned 1 [0088.653] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b3f68 | out: hHeap=0x28b0000) returned 1 [0088.653] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b3e48 | out: hHeap=0x28b0000) returned 1 [0088.653] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b4440 | out: hHeap=0x28b0000) returned 1 [0088.653] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b4538 | out: hHeap=0x28b0000) returned 1 [0088.653] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b4410 | out: hHeap=0x28b0000) returned 1 [0088.653] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b4588 | out: hHeap=0x28b0000) returned 1 [0088.653] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b43f8 | out: hHeap=0x28b0000) returned 1 [0088.653] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b42d8 | out: hHeap=0x28b0000) returned 1 [0088.654] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b4988 | out: hHeap=0x28b0000) returned 1 [0088.654] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b4a68 | out: hHeap=0x28b0000) returned 1 [0088.654] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b4958 | out: hHeap=0x28b0000) returned 1 [0088.654] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b4ac0 | out: hHeap=0x28b0000) returned 1 [0088.654] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b2fa8 | out: hHeap=0x28b0000) returned 1 [0088.654] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b4838 | out: hHeap=0x28b0000) returned 1 [0088.654] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b4dd0 | out: hHeap=0x28b0000) returned 1 [0088.654] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b4ee0 | out: hHeap=0x28b0000) returned 1 [0088.654] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b4f38 | out: hHeap=0x28b0000) returned 1 [0088.654] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b2fc0 | out: hHeap=0x28b0000) returned 1 [0088.654] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b4cb0 | out: hHeap=0x28b0000) returned 1 [0088.654] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b52c8 | out: hHeap=0x28b0000) returned 1 [0088.654] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b53d8 | out: hHeap=0x28b0000) returned 1 [0088.654] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b5438 | out: hHeap=0x28b0000) returned 1 [0088.654] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b52b0 | out: hHeap=0x28b0000) returned 1 [0088.654] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b5190 | out: hHeap=0x28b0000) returned 1 [0088.654] lstrlenA (lpString="ThunderRT6") returned 10 [0088.655] lstrcpyA (in: lpString1=0x19fdb8, lpString2="ThunderRT6" | out: lpString1="ThunderRT6") returned="ThunderRT6" [0088.655] UnregisterClassA (lpClassName="ThunderRT6Timer", hInstance=0x66000000) returned 1 [0088.655] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b57e0 | out: hHeap=0x28b0000) returned 1 [0088.655] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b2f78 | out: hHeap=0x28b0000) returned 1 [0088.655] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b57c8 | out: hHeap=0x28b0000) returned 1 [0088.655] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b5818 | out: hHeap=0x28b0000) returned 1 [0088.655] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b57b0 | out: hHeap=0x28b0000) returned 1 [0088.655] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b5690 | out: hHeap=0x28b0000) returned 1 [0088.655] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b5a18 | out: hHeap=0x28b0000) returned 1 [0088.655] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b5a00 | out: hHeap=0x28b0000) returned 1 [0088.655] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b58e0 | out: hHeap=0x28b0000) returned 1 [0088.655] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b5d20 | out: hHeap=0x28b0000) returned 1 [0088.655] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b5eb0 | out: hHeap=0x28b0000) returned 1 [0088.655] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b5f38 | out: hHeap=0x28b0000) returned 1 [0088.655] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f1c770 | out: hHeap=0x28b0000) returned 1 [0088.655] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b47a8 | out: hHeap=0x28b0000) returned 1 [0088.656] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b5c00 | out: hHeap=0x28b0000) returned 1 [0088.656] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b47f0 | out: hHeap=0x28b0000) returned 1 [0088.656] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b6358 | out: hHeap=0x28b0000) returned 1 [0088.656] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b47d8 | out: hHeap=0x28b0000) returned 1 [0088.656] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b6238 | out: hHeap=0x28b0000) returned 1 [0088.656] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b04b8 | out: hHeap=0x28b0000) returned 1 [0088.656] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b04e0 | out: hHeap=0x28b0000) returned 1 [0088.656] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b04a0 | out: hHeap=0x28b0000) returned 1 [0088.656] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b9350 | out: hHeap=0x28b0000) returned 1 [0088.656] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b9590 | out: hHeap=0x28b0000) returned 1 [0088.656] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b0570 | out: hHeap=0x28b0000) returned 1 [0088.656] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b95d0 | out: hHeap=0x28b0000) returned 1 [0088.656] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b4828 | out: hHeap=0x28b0000) returned 1 [0088.656] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b9470 | out: hHeap=0x28b0000) returned 1 [0088.656] lstrlenA (lpString="ThunderRT6") returned 10 [0088.657] lstrcpyA (in: lpString1=0x19fdb8, lpString2="ThunderRT6" | out: lpString1="ThunderRT6") returned="ThunderRT6" [0088.657] UnregisterClassA (lpClassName="ThunderRT6MDIForm", hInstance=0x66000000) returned 1 [0088.657] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b9fb8 | out: hHeap=0x28b0000) returned 1 [0088.657] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28ba148 | out: hHeap=0x28b0000) returned 1 [0088.657] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28ba1d0 | out: hHeap=0x28b0000) returned 1 [0088.657] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b0580 | out: hHeap=0x28b0000) returned 1 [0088.657] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b9e98 | out: hHeap=0x28b0000) returned 1 [0088.657] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b5b00 | out: hHeap=0x28b0000) returned 1 [0088.657] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28ba740 | out: hHeap=0x28b0000) returned 1 [0088.657] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b0598 | out: hHeap=0x28b0000) returned 1 [0088.657] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28ba620 | out: hHeap=0x28b0000) returned 1 [0088.657] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28bbaa0 | out: hHeap=0x28b0000) returned 1 [0088.657] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28bbc90 | out: hHeap=0x28b0000) returned 1 [0088.657] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28bbd48 | out: hHeap=0x28b0000) returned 1 [0088.657] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28bba28 | out: hHeap=0x28b0000) returned 1 [0088.657] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28bb570 | out: hHeap=0x28b0000) returned 1 [0088.657] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28bc0f8 | out: hHeap=0x28b0000) returned 1 [0088.658] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28bc290 | out: hHeap=0x28b0000) returned 1 [0088.658] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28bc320 | out: hHeap=0x28b0000) returned 1 [0088.658] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28bba40 | out: hHeap=0x28b0000) returned 1 [0088.658] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28bab08 | out: hHeap=0x28b0000) returned 1 [0088.658] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28bc638 | out: hHeap=0x28b0000) returned 1 [0088.658] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28bc808 | out: hHeap=0x28b0000) returned 1 [0088.658] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28bc8b8 | out: hHeap=0x28b0000) returned 1 [0088.658] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28bb8f0 | out: hHeap=0x28b0000) returned 1 [0088.658] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28bb0d0 | out: hHeap=0x28b0000) returned 1 [0088.658] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28bce70 | out: hHeap=0x28b0000) returned 1 [0088.658] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b5bb8 | out: hHeap=0x28b0000) returned 1 [0088.658] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b9a38 | out: hHeap=0x28b0000) returned 1 [0088.658] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28bcc30 | out: hHeap=0x28b0000) returned 1 [0088.658] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28bb448 | out: hHeap=0x28b0000) returned 1 [0088.658] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28bd158 | out: hHeap=0x28b0000) returned 1 [0088.658] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28bd290 | out: hHeap=0x28b0000) returned 1 [0088.659] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28ba4d0 | out: hHeap=0x28b0000) returned 1 [0088.659] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28bb698 | out: hHeap=0x28b0000) returned 1 [0088.659] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28bd520 | out: hHeap=0x28b0000) returned 1 [0088.659] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28bd668 | out: hHeap=0x28b0000) returned 1 [0088.659] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b99d8 | out: hHeap=0x28b0000) returned 1 [0088.659] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28bd2c0 | out: hHeap=0x28b0000) returned 1 [0088.659] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28ba8b8 | out: hHeap=0x28b0000) returned 1 [0088.659] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28bd8b8 | out: hHeap=0x28b0000) returned 1 [0088.659] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28bda00 | out: hHeap=0x28b0000) returned 1 [0088.659] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28bb980 | out: hHeap=0x28b0000) returned 1 [0088.660] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28bd698 | out: hHeap=0x28b0000) returned 1 [0088.660] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28bac30 | out: hHeap=0x28b0000) returned 1 [0088.660] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28bdc08 | out: hHeap=0x28b0000) returned 1 [0088.660] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28bdd50 | out: hHeap=0x28b0000) returned 1 [0088.660] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28bb968 | out: hHeap=0x28b0000) returned 1 [0088.660] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28bda30 | out: hHeap=0x28b0000) returned 1 [0088.660] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28bad58 | out: hHeap=0x28b0000) returned 1 [0088.660] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28bdf48 | out: hHeap=0x28b0000) returned 1 [0088.660] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28be090 | out: hHeap=0x28b0000) returned 1 [0088.660] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28bba70 | out: hHeap=0x28b0000) returned 1 [0088.660] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28bdd80 | out: hHeap=0x28b0000) returned 1 [0088.660] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28ba9e0 | out: hHeap=0x28b0000) returned 1 [0088.660] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28bcfb8 | out: hHeap=0x28b0000) returned 1 [0088.660] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28bd100 | out: hHeap=0x28b0000) returned 1 [0088.660] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b96f8 | out: hHeap=0x28b0000) returned 1 [0088.660] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28be2b0 | out: hHeap=0x28b0000) returned 1 [0088.660] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28bae80 | out: hHeap=0x28b0000) returned 1 [0088.661] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28be6a0 | out: hHeap=0x28b0000) returned 1 [0088.661] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28be7e8 | out: hHeap=0x28b0000) returned 1 [0088.661] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b99b8 | out: hHeap=0x28b0000) returned 1 [0088.661] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28be4a8 | out: hHeap=0x28b0000) returned 1 [0088.661] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28bb1f8 | out: hHeap=0x28b0000) returned 1 [0088.661] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28be968 | out: hHeap=0x28b0000) returned 1 [0088.661] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28beaa0 | out: hHeap=0x28b0000) returned 1 [0088.661] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28be818 | out: hHeap=0x28b0000) returned 1 [0088.661] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28bafa8 | out: hHeap=0x28b0000) returned 1 [0088.661] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28becc8 | out: hHeap=0x28b0000) returned 1 [0088.661] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28bee10 | out: hHeap=0x28b0000) returned 1 [0088.661] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b9a58 | out: hHeap=0x28b0000) returned 1 [0088.662] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28bead0 | out: hHeap=0x28b0000) returned 1 [0088.662] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28bb320 | out: hHeap=0x28b0000) returned 1 [0088.662] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f12050 | out: hHeap=0x28b0000) returned 1 [0088.662] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f12198 | out: hHeap=0x28b0000) returned 1 [0088.662] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b97d8 | out: hHeap=0x28b0000) returned 1 [0088.662] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28bee40 | out: hHeap=0x28b0000) returned 1 [0088.662] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f111c8 | out: hHeap=0x28b0000) returned 1 [0088.662] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f12408 | out: hHeap=0x28b0000) returned 1 [0088.662] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f12550 | out: hHeap=0x28b0000) returned 1 [0088.662] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b98d8 | out: hHeap=0x28b0000) returned 1 [0088.662] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28be0c0 | out: hHeap=0x28b0000) returned 1 [0088.662] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f112f0 | out: hHeap=0x28b0000) returned 1 [0088.663] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f12740 | out: hHeap=0x28b0000) returned 1 [0088.663] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f12888 | out: hHeap=0x28b0000) returned 1 [0088.663] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b98f8 | out: hHeap=0x28b0000) returned 1 [0088.663] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f12580 | out: hHeap=0x28b0000) returned 1 [0088.663] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f11b08 | out: hHeap=0x28b0000) returned 1 [0088.663] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f12ac8 | out: hHeap=0x28b0000) returned 1 [0088.663] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f12d88 | out: hHeap=0x28b0000) returned 1 [0088.663] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b9778 | out: hHeap=0x28b0000) returned 1 [0088.663] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f128b8 | out: hHeap=0x28b0000) returned 1 [0088.663] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f11418 | out: hHeap=0x28b0000) returned 1 [0088.663] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f13228 | out: hHeap=0x28b0000) returned 1 [0088.663] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f12ed8 | out: hHeap=0x28b0000) returned 1 [0088.663] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b97f8 | out: hHeap=0x28b0000) returned 1 [0088.663] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f13018 | out: hHeap=0x28b0000) returned 1 [0088.663] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f11790 | out: hHeap=0x28b0000) returned 1 [0088.663] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f134d8 | out: hHeap=0x28b0000) returned 1 [0088.663] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f12db8 | out: hHeap=0x28b0000) returned 1 [0088.663] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28bba58 | out: hHeap=0x28b0000) returned 1 [0088.664] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f13370 | out: hHeap=0x28b0000) returned 1 [0088.664] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f11540 | out: hHeap=0x28b0000) returned 1 [0088.664] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f140b8 | out: hHeap=0x28b0000) returned 1 [0088.664] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f12de8 | out: hHeap=0x28b0000) returned 1 [0088.664] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f121c8 | out: hHeap=0x28b0000) returned 1 [0088.664] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f11668 | out: hHeap=0x28b0000) returned 1 [0088.664] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f14420 | out: hHeap=0x28b0000) returned 1 [0088.664] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f12e78 | out: hHeap=0x28b0000) returned 1 [0088.664] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f13cf8 | out: hHeap=0x28b0000) returned 1 [0088.664] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f141f0 | out: hHeap=0x28b0000) returned 1 [0088.664] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f10e50 | out: hHeap=0x28b0000) returned 1 [0088.664] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f14ca0 | out: hHeap=0x28b0000) returned 1 [0088.664] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f12f38 | out: hHeap=0x28b0000) returned 1 [0088.664] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f13db8 | out: hHeap=0x28b0000) returned 1 [0088.664] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f14568 | out: hHeap=0x28b0000) returned 1 [0088.664] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f118b8 | out: hHeap=0x28b0000) returned 1 [0088.665] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f15a18 | out: hHeap=0x28b0000) returned 1 [0088.665] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f12f68 | out: hHeap=0x28b0000) returned 1 [0088.665] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f158a8 | out: hHeap=0x28b0000) returned 1 [0088.665] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f10510 | out: hHeap=0x28b0000) returned 1 [0088.665] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f15ca0 | out: hHeap=0x28b0000) returned 1 [0088.665] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f12cf8 | out: hHeap=0x28b0000) returned 1 [0088.665] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f15b50 | out: hHeap=0x28b0000) returned 1 [0088.665] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f119e0 | out: hHeap=0x28b0000) returned 1 [0088.665] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f13f70 | out: hHeap=0x28b0000) returned 1 [0088.665] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f12d28 | out: hHeap=0x28b0000) returned 1 [0088.665] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f160b8 | out: hHeap=0x28b0000) returned 1 [0088.665] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f11c30 | out: hHeap=0x28b0000) returned 1 [0088.665] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f156e0 | out: hHeap=0x28b0000) returned 1 [0088.665] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f12cc8 | out: hHeap=0x28b0000) returned 1 [0088.665] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f13c78 | out: hHeap=0x28b0000) returned 1 [0088.665] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f16208 | out: hHeap=0x28b0000) returned 1 [0088.666] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f110a0 | out: hHeap=0x28b0000) returned 1 [0088.666] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f13620 | out: hHeap=0x28b0000) returned 1 [0088.666] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f12d58 | out: hHeap=0x28b0000) returned 1 [0088.666] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f16428 | out: hHeap=0x28b0000) returned 1 [0088.666] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f10888 | out: hHeap=0x28b0000) returned 1 [0088.666] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f166b0 | out: hHeap=0x28b0000) returned 1 [0088.666] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f12e18 | out: hHeap=0x28b0000) returned 1 [0088.666] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f16578 | out: hHeap=0x28b0000) returned 1 [0088.666] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f10f78 | out: hHeap=0x28b0000) returned 1 [0088.666] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f14f30 | out: hHeap=0x28b0000) returned 1 [0088.666] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f12f98 | out: hHeap=0x28b0000) returned 1 [0088.666] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f13c58 | out: hHeap=0x28b0000) returned 1 [0088.666] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f167e8 | out: hHeap=0x28b0000) returned 1 [0088.666] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f10638 | out: hHeap=0x28b0000) returned 1 [0088.666] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f148c8 | out: hHeap=0x28b0000) returned 1 [0088.666] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f12e48 | out: hHeap=0x28b0000) returned 1 [0088.666] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f13bf8 | out: hHeap=0x28b0000) returned 1 [0088.667] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f16d40 | out: hHeap=0x28b0000) returned 1 [0088.667] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f11d58 | out: hHeap=0x28b0000) returned 1 [0088.667] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f14a10 | out: hHeap=0x28b0000) returned 1 [0088.667] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f12fc8 | out: hHeap=0x28b0000) returned 1 [0088.667] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f13dd8 | out: hHeap=0x28b0000) returned 1 [0088.667] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f15dd8 | out: hHeap=0x28b0000) returned 1 [0088.667] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f11e80 | out: hHeap=0x28b0000) returned 1 [0088.667] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f14de8 | out: hHeap=0x28b0000) returned 1 [0088.667] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f12ea8 | out: hHeap=0x28b0000) returned 1 [0088.667] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f13d78 | out: hHeap=0x28b0000) returned 1 [0088.667] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f171e0 | out: hHeap=0x28b0000) returned 1 [0088.667] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f10ad8 | out: hHeap=0x28b0000) returned 1 [0088.667] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f15450 | out: hHeap=0x28b0000) returned 1 [0088.667] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f12f08 | out: hHeap=0x28b0000) returned 1 [0088.667] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28bba88 | out: hHeap=0x28b0000) returned 1 [0088.667] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f17428 | out: hHeap=0x28b0000) returned 1 [0088.668] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f10070 | out: hHeap=0x28b0000) returned 1 [0088.668] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f15078 | out: hHeap=0x28b0000) returned 1 [0088.668] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f12c38 | out: hHeap=0x28b0000) returned 1 [0088.668] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f13e78 | out: hHeap=0x28b0000) returned 1 [0088.668] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f17588 | out: hHeap=0x28b0000) returned 1 [0088.668] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f10198 | out: hHeap=0x28b0000) returned 1 [0088.668] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f151c0 | out: hHeap=0x28b0000) returned 1 [0088.668] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f12c68 | out: hHeap=0x28b0000) returned 1 [0088.668] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f13ed8 | out: hHeap=0x28b0000) returned 1 [0088.668] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f16a10 | out: hHeap=0x28b0000) returned 1 [0088.668] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f10760 | out: hHeap=0x28b0000) returned 1 [0088.668] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f15598 | out: hHeap=0x28b0000) returned 1 [0088.668] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f12c98 | out: hHeap=0x28b0000) returned 1 [0088.668] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f13d38 | out: hHeap=0x28b0000) returned 1 [0088.668] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f16b38 | out: hHeap=0x28b0000) returned 1 [0088.668] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f109b0 | out: hHeap=0x28b0000) returned 1 [0088.669] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f15308 | out: hHeap=0x28b0000) returned 1 [0088.669] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f18110 | out: hHeap=0x28b0000) returned 1 [0088.669] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f13cb8 | out: hHeap=0x28b0000) returned 1 [0088.669] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f17bd0 | out: hHeap=0x28b0000) returned 1 [0088.669] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f102c0 | out: hHeap=0x28b0000) returned 1 [0088.669] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f16018 | out: hHeap=0x28b0000) returned 1 [0088.669] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f17d50 | out: hHeap=0x28b0000) returned 1 [0088.669] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f18050 | out: hHeap=0x28b0000) returned 1 [0088.669] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f18870 | out: hHeap=0x28b0000) returned 1 [0088.669] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28bb9e0 | out: hHeap=0x28b0000) returned 1 [0088.669] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f103e8 | out: hHeap=0x28b0000) returned 1 [0089.262] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f189c0 | out: hHeap=0x28b0000) returned 1 [0089.262] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f181a0 | out: hHeap=0x28b0000) returned 1 [0089.262] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f17e70 | out: hHeap=0x28b0000) returned 1 [0089.262] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f18a58 | out: hHeap=0x28b0000) returned 1 [0089.262] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28bb938 | out: hHeap=0x28b0000) returned 1 [0089.263] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f10c00 | out: hHeap=0x28b0000) returned 1 [0089.263] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f17850 | out: hHeap=0x28b0000) returned 1 [0089.263] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f18f78 | out: hHeap=0x28b0000) returned 1 [0089.263] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f17ff0 | out: hHeap=0x28b0000) returned 1 [0089.263] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f17918 | out: hHeap=0x28b0000) returned 1 [0089.263] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28bb9f8 | out: hHeap=0x28b0000) returned 1 [0089.263] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f10d28 | out: hHeap=0x28b0000) returned 1 [0089.263] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f17ac0 | out: hHeap=0x28b0000) returned 1 [0089.263] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f1afc8 | out: hHeap=0x28b0000) returned 1 [0089.263] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f17db0 | out: hHeap=0x28b0000) returned 1 [0089.263] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f1b020 | out: hHeap=0x28b0000) returned 1 [0089.263] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28bb950 | out: hHeap=0x28b0000) returned 1 [0089.264] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f1a708 | out: hHeap=0x28b0000) returned 1 [0089.264] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f1b1d8 | out: hHeap=0x28b0000) returned 1 [0089.264] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f1b2d0 | out: hHeap=0x28b0000) returned 1 [0089.264] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f17d80 | out: hHeap=0x28b0000) returned 1 [0089.264] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f1b330 | out: hHeap=0x28b0000) returned 1 [0089.264] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28bba10 | out: hHeap=0x28b0000) returned 1 [0089.264] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f1adf8 | out: hHeap=0x28b0000) returned 1 [0089.264] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f1b938 | out: hHeap=0x28b0000) returned 1 [0089.264] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28be288 | out: hHeap=0x28b0000) returned 1 [0089.264] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f1b9a8 | out: hHeap=0x28b0000) returned 1 [0089.264] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f1b650 | out: hHeap=0x28b0000) returned 1 [0089.264] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f1a018 | out: hHeap=0x28b0000) returned 1 [0089.265] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f1bab0 | out: hHeap=0x28b0000) returned 1 [0089.265] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f13a38 | out: hHeap=0x28b0000) returned 1 [0089.265] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f1bb08 | out: hHeap=0x28b0000) returned 1 [0089.265] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f13758 | out: hHeap=0x28b0000) returned 1 [0089.265] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f19a50 | out: hHeap=0x28b0000) returned 1 [0089.265] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f18ba8 | out: hHeap=0x28b0000) returned 1 [0089.265] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f17b90 | out: hHeap=0x28b0000) returned 1 [0089.265] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f17fc0 | out: hHeap=0x28b0000) returned 1 [0089.265] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f18c48 | out: hHeap=0x28b0000) returned 1 [0089.265] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f1b560 | out: hHeap=0x28b0000) returned 1 [0089.265] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f195b0 | out: hHeap=0x28b0000) returned 1 [0089.265] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f18da8 | out: hHeap=0x28b0000) returned 1 [0089.265] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f18e88 | out: hHeap=0x28b0000) returned 1 [0089.265] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f1c000 | out: hHeap=0x28b0000) returned 1 [0089.265] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f140a8 | out: hHeap=0x28b0000) returned 1 [0089.265] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f196d8 | out: hHeap=0x28b0000) returned 1 [0089.266] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f1c1e0 | out: hHeap=0x28b0000) returned 1 [0089.266] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f18ed0 | out: hHeap=0x28b0000) returned 1 [0089.266] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f1c368 | out: hHeap=0x28b0000) returned 1 [0089.266] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b5be8 | out: hHeap=0x28b0000) returned 1 [0089.266] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f19ca0 | out: hHeap=0x28b0000) returned 1 [0089.266] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b5b90 | out: hHeap=0x28b0000) returned 1 [0089.266] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b2068 | out: hHeap=0x28b0000) returned 1 [0089.266] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f13838 | out: hHeap=0x28b0000) returned 1 [0089.266] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f13958 | out: hHeap=0x28b0000) returned 1 [0089.266] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b20a0 | out: hHeap=0x28b0000) returned 1 [0089.266] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b9818 | out: hHeap=0x28b0000) returned 1 [0089.266] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f13c18 | out: hHeap=0x28b0000) returned 1 [0089.266] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b99f8 | out: hHeap=0x28b0000) returned 1 [0089.266] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f13af8 | out: hHeap=0x28b0000) returned 1 [0089.266] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b96b8 | out: hHeap=0x28b0000) returned 1 [0089.266] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f13ef8 | out: hHeap=0x28b0000) returned 1 [0089.267] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b9878 | out: hHeap=0x28b0000) returned 1 [0089.267] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f13f18 | out: hHeap=0x28b0000) returned 1 [0089.267] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b9918 | out: hHeap=0x28b0000) returned 1 [0089.267] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f13798 | out: hHeap=0x28b0000) returned 1 [0089.267] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f13a58 | out: hHeap=0x28b0000) returned 1 [0089.267] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b9a78 | out: hHeap=0x28b0000) returned 1 [0089.267] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f13c38 | out: hHeap=0x28b0000) returned 1 [0089.267] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b9978 | out: hHeap=0x28b0000) returned 1 [0089.267] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b4788 | out: hHeap=0x28b0000) returned 1 [0089.267] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f138b8 | out: hHeap=0x28b0000) returned 1 [0089.267] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b5670 | out: hHeap=0x28b0000) returned 1 [0089.267] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b9738 | out: hHeap=0x28b0000) returned 1 [0089.267] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b98b8 | out: hHeap=0x28b0000) returned 1 [0089.267] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f13cd8 | out: hHeap=0x28b0000) returned 1 [0089.267] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f13e58 | out: hHeap=0x28b0000) returned 1 [0089.267] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b3e28 | out: hHeap=0x28b0000) returned 1 [0089.267] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b2f58 | out: hHeap=0x28b0000) returned 1 [0089.267] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b9998 | out: hHeap=0x28b0000) returned 1 [0089.267] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f13d58 | out: hHeap=0x28b0000) returned 1 [0089.267] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b42b8 | out: hHeap=0x28b0000) returned 1 [0089.267] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f13f38 | out: hHeap=0x28b0000) returned 1 [0089.267] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f13eb8 | out: hHeap=0x28b0000) returned 1 [0089.267] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b9938 | out: hHeap=0x28b0000) returned 1 [0089.267] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f13978 | out: hHeap=0x28b0000) returned 1 [0089.267] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b9958 | out: hHeap=0x28b0000) returned 1 [0089.268] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b9838 | out: hHeap=0x28b0000) returned 1 [0089.268] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f13c98 | out: hHeap=0x28b0000) returned 1 [0089.268] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b9718 | out: hHeap=0x28b0000) returned 1 [0089.268] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b9858 | out: hHeap=0x28b0000) returned 1 [0089.268] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b9898 | out: hHeap=0x28b0000) returned 1 [0089.268] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f13b18 | out: hHeap=0x28b0000) returned 1 [0089.268] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b47b8 | out: hHeap=0x28b0000) returned 1 [0089.268] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b9798 | out: hHeap=0x28b0000) returned 1 [0089.268] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f13df8 | out: hHeap=0x28b0000) returned 1 [0089.268] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f13e98 | out: hHeap=0x28b0000) returned 1 [0089.268] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b4c90 | out: hHeap=0x28b0000) returned 1 [0089.268] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f13e38 | out: hHeap=0x28b0000) returned 1 [0089.268] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f13a78 | out: hHeap=0x28b0000) returned 1 [0089.268] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b96d8 | out: hHeap=0x28b0000) returned 1 [0089.268] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b3498 | out: hHeap=0x28b0000) returned 1 [0089.268] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b9a18 | out: hHeap=0x28b0000) returned 1 [0089.268] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f13bd8 | out: hHeap=0x28b0000) returned 1 [0089.268] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b9758 | out: hHeap=0x28b0000) returned 1 [0089.268] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f13e18 | out: hHeap=0x28b0000) returned 1 [0089.268] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f13b98 | out: hHeap=0x28b0000) returned 1 [0089.268] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f13d18 | out: hHeap=0x28b0000) returned 1 [0089.268] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b5170 | out: hHeap=0x28b0000) returned 1 [0089.268] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f13bb8 | out: hHeap=0x28b0000) returned 1 [0089.268] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f13b38 | out: hHeap=0x28b0000) returned 1 [0089.268] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f137b8 | out: hHeap=0x28b0000) returned 1 [0089.268] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b2f88 | out: hHeap=0x28b0000) returned 1 [0089.268] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b0550 | out: hHeap=0x28b0000) returned 1 [0089.268] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f13d98 | out: hHeap=0x28b0000) returned 1 [0089.268] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b58c0 | out: hHeap=0x28b0000) returned 1 [0089.268] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b3a18 | out: hHeap=0x28b0000) returned 1 [0089.269] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b6400 | out: hHeap=0x28b0000) returned 1 [0089.269] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b97b8 | out: hHeap=0x28b0000) returned 1 [0089.269] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f137f8 | out: hHeap=0x28b0000) returned 1 [0089.269] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b24e0 | out: hHeap=0x28b0000) returned 1 [0089.269] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f1bdf0 | out: hHeap=0x28b0000) returned 1 [0089.269] HeapFree (in: hHeap=0x2c00000, dwFlags=0x0, lpMem=0x2c005a8 | out: hHeap=0x2c00000) returned 1 [0089.269] GetCursorPos (in: lpPoint=0x19fe44 | out: lpPoint=0x19fe44*(x=130, y=878)) returned 1 [0089.269] GetCapture () returned 0x0 [0089.269] WindowFromPoint (Point=0x82) returned 0x10092 [0089.269] GetWindowThreadProcessId (in: hWnd=0x10092, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x69c [0089.269] DestroyWindow (hWnd=0x401e8) returned 0 [0089.269] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b1fc0 | out: hHeap=0x28b0000) returned 1 [0089.269] CPicture::Release () returned 0x0 [0089.270] CPicture::Release () returned 0x0 [0089.270] DeleteDC (hdc=0x27010949) returned 1 [0089.270] IMalloc:Free (This=0x75638d00, pv=0x70e978) [0089.270] IMalloc:Free (This=0x75638d00, pv=0x6fac78) [0089.270] IMalloc:Free (This=0x75638d00, pv=0x70c3f0) [0089.270] IMalloc:Free (This=0x75638d00, pv=0x70c340) [0089.270] IMalloc:Free (This=0x75638d00, pv=0x71b948) [0089.271] IMalloc:Free (This=0x75638d00, pv=0x6fa9f8) [0089.271] CoRegisterMessageFilter (in: lpMessageFilter=0x0, lplpMessageFilter=0x19fe84 | out: lplpMessageFilter=0x19fe84*=0x28b1e2c) returned 0x0 [0089.271] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b1e28 | out: hHeap=0x28b0000) returned 1 [0089.271] UnhookWindowsHookEx (hhk=0x1100c7) returned 1 [0089.271] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b1fa8 | out: hHeap=0x28b0000) returned 1 [0089.271] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b1f88 | out: hHeap=0x28b0000) returned 1 [0089.271] GetTickCount () returned 0x19b789b [0089.271] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b1ef8 | out: hHeap=0x28b0000) returned 1 [0089.271] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b1f48 | out: hHeap=0x28b0000) returned 1 [0089.271] SetWindowLongA (hWnd=0x80288, nIndex=0, dwNewLong=0) returned 42671732 [0089.271] DestroyWindow (hWnd=0x80288) returned 1 [0089.272] NtdllDefWindowProc_A (hWnd=0x80288, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0089.273] NtdllDefWindowProc_A (hWnd=0x80288, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0 [0089.280] NtdllDefWindowProc_A (hWnd=0x80288, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0089.281] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b1e70 | out: hHeap=0x28b0000) returned 1 [0089.281] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b1e50 | out: hHeap=0x28b0000) returned 1 [0089.281] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b1f10 | out: hHeap=0x28b0000) returned 1 [0089.281] HeapDestroy (hHeap=0x2c00000) returned 1 [0089.282] GlobalDeleteAtom (nAtom=0xc086) returned 0x0 [0089.282] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b15b8 | out: hHeap=0x28b0000) returned 1 [0089.282] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b1588 | out: hHeap=0x28b0000) returned 1 [0089.282] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f1bbe0 | out: hHeap=0x28b0000) returned 1 [0089.282] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b2920 | out: hHeap=0x28b0000) returned 1 [0089.283] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b15e8 | out: hHeap=0x28b0000) returned 1 [0089.284] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b1998 | out: hHeap=0x28b0000) returned 1 [0089.284] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b1d48 | out: hHeap=0x28b0000) returned 1 [0089.284] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x1f1ce70 | out: hHeap=0x28b0000) returned 1 [0089.284] VirtualFree (lpAddress=0x4b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.285] IMalloc:Free (This=0x75638d00, pv=0x6ff408) [0089.285] IMalloc:Free (This=0x75638d00, pv=0x7491c0) [0089.285] IUnknown:AddRef (This=0x75638d00) returned 0x1 [0089.285] Sleep (dwMilliseconds=0x0) [0089.649] CoFreeUnusedLibraries () [0089.649] OleUninitialize () [0089.658] FreeLibrary (hLibModule=0x76150000) returned 1 [0089.658] ReleaseSemaphore (in: hSemaphore=0x114, lReleaseCount=1, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0089.659] GetCurrentThreadId () returned 0xa7c [0089.659] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b06b8 | out: hHeap=0x28b0000) returned 1 [0089.659] HeapFree (in: hHeap=0x28b0000, dwFlags=0x0, lpMem=0x28b05a8 | out: hHeap=0x28b0000) returned 1 [0089.659] ExitProcess (uExitCode=0x0) [0089.661] GetCurrentThreadId () returned 0xa7c [0089.661] GetCurrentThreadId () returned 0xa7c [0089.662] IUnknown:AddRef (This=0x75638d00) returned 0x1 [0089.662] HeapDestroy (hHeap=0x28b0000) returned 1 [0089.663] CloseHandle (hObject=0xfc) returned 1 [0089.663] CloseHandle (hObject=0x100) returned 1 [0089.664] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4c0ac0 | out: hHeap=0x4c0000) returned 1 [0089.665] VirtualFree (lpAddress=0x2020000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.665] HeapDestroy (hHeap=0x4c0000) returned 1 Thread: id = 2 os_tid = 0x5bc Process: id = "2" image_name = "regasm.exe" filename = "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\regasm.exe" page_root = "0x498f1000" os_pid = "0x370" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x864" cmd_line = "\"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe\"" cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f142" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 361 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 362 start_va = 0x30000 end_va = 0x31fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 363 start_va = 0x40000 end_va = 0x54fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 364 start_va = 0x60000 end_va = 0x9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000060000" filename = "" Region: id = 365 start_va = 0xa0000 end_va = 0x19ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000a0000" filename = "" Region: id = 366 start_va = 0x1a0000 end_va = 0x1a3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 367 start_va = 0x1b0000 end_va = 0x1b0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 368 start_va = 0x1c0000 end_va = 0x1c1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 369 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 370 start_va = 0x400000 end_va = 0x411fff monitored = 0 entry_point = 0x40ccb6 region_type = mapped_file name = "regasm.exe" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\regasm.exe") Region: id = 371 start_va = 0x778f0000 end_va = 0x77a6afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 372 start_va = 0x7ffb0000 end_va = 0x7ffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007ffb0000" filename = "" Region: id = 373 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 374 start_va = 0x7fff0000 end_va = 0x7ffb28afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 375 start_va = 0x7ffb28b00000 end_va = 0x7ffb28cc0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 376 start_va = 0x7ffb28cc1000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffb28cc1000" filename = "" Region: id = 377 start_va = 0x400000 end_va = 0x411fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 378 start_va = 0x4a0000 end_va = 0x4affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004a0000" filename = "" Region: id = 379 start_va = 0x657b0000 end_va = 0x65829fff monitored = 0 entry_point = 0x657c3290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 380 start_va = 0x65840000 end_va = 0x6588ffff monitored = 0 entry_point = 0x65858180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 381 start_va = 0x74650000 end_va = 0x7472ffff monitored = 0 entry_point = 0x74663980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 382 start_va = 0x65830000 end_va = 0x65837fff monitored = 0 entry_point = 0x658317c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 383 start_va = 0x4b0000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 384 start_va = 0x6cd20000 end_va = 0x6cd78fff monitored = 1 entry_point = 0x6cd30780 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\SysWOW64\\mscoree.dll" (normalized: "c:\\windows\\syswow64\\mscoree.dll") Region: id = 385 start_va = 0x74650000 end_va = 0x7472ffff monitored = 0 entry_point = 0x74663980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 386 start_va = 0x75e80000 end_va = 0x75ffdfff monitored = 0 entry_point = 0x75f31b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 387 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 388 start_va = 0x7feb0000 end_va = 0x7ffaffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007feb0000" filename = "" Region: id = 389 start_va = 0x4b0000 end_va = 0x56dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 390 start_va = 0x670000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000670000" filename = "" Region: id = 391 start_va = 0x770000 end_va = 0x94ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000770000" filename = "" Region: id = 392 start_va = 0x74570000 end_va = 0x74601fff monitored = 0 entry_point = 0x745b0380 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 393 start_va = 0x7fb00000 end_va = 0x7fea0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sysmain.sdb" filename = "\\Windows\\AppPatch\\sysmain.sdb" (normalized: "c:\\windows\\apppatch\\sysmain.sdb") Region: id = 394 start_va = 0x20000 end_va = 0x23fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 395 start_va = 0x6ca00000 end_va = 0x6cc77fff monitored = 0 entry_point = 0x6ca15e90 region_type = mapped_file name = "aclayers.dll" filename = "\\Windows\\AppPatch\\AcLayers.dll" (normalized: "c:\\windows\\apppatch\\aclayers.dll") Region: id = 396 start_va = 0x75680000 end_va = 0x7573dfff monitored = 0 entry_point = 0x756b5630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 397 start_va = 0x74790000 end_va = 0x748d6fff monitored = 0 entry_point = 0x747a1cf0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 398 start_va = 0x758f0000 end_va = 0x75a3efff monitored = 0 entry_point = 0x759a6820 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 399 start_va = 0x76370000 end_va = 0x7776efff monitored = 0 entry_point = 0x7652b990 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll") Region: id = 400 start_va = 0x75300000 end_va = 0x75336fff monitored = 0 entry_point = 0x75303b50 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\SysWOW64\\cfgmgr32.dll" (normalized: "c:\\windows\\syswow64\\cfgmgr32.dll") Region: id = 401 start_va = 0x74c60000 end_va = 0x75158fff monitored = 0 entry_point = 0x74e67610 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\SysWOW64\\windows.storage.dll" (normalized: "c:\\windows\\syswow64\\windows.storage.dll") Region: id = 402 start_va = 0x754b0000 end_va = 0x7566cfff monitored = 0 entry_point = 0x75592a10 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 403 start_va = 0x74b50000 end_va = 0x74bfcfff monitored = 0 entry_point = 0x74b64f00 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 404 start_va = 0x74620000 end_va = 0x7463dfff monitored = 0 entry_point = 0x7462b640 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 405 start_va = 0x74610000 end_va = 0x74619fff monitored = 0 entry_point = 0x74612a00 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 406 start_va = 0x74730000 end_va = 0x74787fff monitored = 0 entry_point = 0x747725c0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 407 start_va = 0x75740000 end_va = 0x75783fff monitored = 0 entry_point = 0x75759d80 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 408 start_va = 0x77820000 end_va = 0x7789afff monitored = 0 entry_point = 0x7783e970 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 409 start_va = 0x75790000 end_va = 0x757d4fff monitored = 0 entry_point = 0x757ade90 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 410 start_va = 0x757e0000 end_va = 0x757ebfff monitored = 0 entry_point = 0x757e3930 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 411 start_va = 0x748e0000 end_va = 0x7496cfff monitored = 0 entry_point = 0x74929b90 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll") Region: id = 412 start_va = 0x77770000 end_va = 0x777b3fff monitored = 0 entry_point = 0x77777410 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\SysWOW64\\powrprof.dll" (normalized: "c:\\windows\\syswow64\\powrprof.dll") Region: id = 413 start_va = 0x757f0000 end_va = 0x757fefff monitored = 0 entry_point = 0x757f2e40 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll") Region: id = 414 start_va = 0x76150000 end_va = 0x761e1fff monitored = 0 entry_point = 0x76188cf0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 415 start_va = 0x75a40000 end_va = 0x75e4afff monitored = 0 entry_point = 0x75a6adf0 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\SysWOW64\\setupapi.dll" (normalized: "c:\\windows\\syswow64\\setupapi.dll") Region: id = 416 start_va = 0x6cdb0000 end_va = 0x6cdc5fff monitored = 0 entry_point = 0x6cdb21d0 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll") Region: id = 417 start_va = 0x66680000 end_va = 0x66682fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sfc.dll" filename = "\\Windows\\SysWOW64\\sfc.dll" (normalized: "c:\\windows\\syswow64\\sfc.dll") Region: id = 418 start_va = 0x6c810000 end_va = 0x6c876fff monitored = 0 entry_point = 0x6c825a00 region_type = mapped_file name = "winspool.drv" filename = "\\Windows\\SysWOW64\\winspool.drv" (normalized: "c:\\windows\\syswow64\\winspool.drv") Region: id = 419 start_va = 0x742c0000 end_va = 0x742dafff monitored = 0 entry_point = 0x742c9050 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll") Region: id = 420 start_va = 0x6ffd0000 end_va = 0x6ffdefff monitored = 0 entry_point = 0x6ffd63e0 region_type = mapped_file name = "sfc_os.dll" filename = "\\Windows\\SysWOW64\\sfc_os.dll" (normalized: "c:\\windows\\syswow64\\sfc_os.dll") Region: id = 421 start_va = 0x770000 end_va = 0x87ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000770000" filename = "" Region: id = 422 start_va = 0x940000 end_va = 0x94ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000940000" filename = "" Region: id = 423 start_va = 0x1d0000 end_va = 0x1f9fff monitored = 0 entry_point = 0x1d5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 424 start_va = 0x950000 end_va = 0xad7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000950000" filename = "" Region: id = 425 start_va = 0x75e50000 end_va = 0x75e7afff monitored = 0 entry_point = 0x75e55680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 426 start_va = 0x30000 end_va = 0x30fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 427 start_va = 0x1d0000 end_va = 0x1d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 428 start_va = 0xae0000 end_va = 0xc60fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ae0000" filename = "" Region: id = 429 start_va = 0xc70000 end_va = 0x206ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000c70000" filename = "" Region: id = 430 start_va = 0x570000 end_va = 0x659fff monitored = 0 entry_point = 0x5ad650 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 431 start_va = 0x6ce10000 end_va = 0x6ce88fff monitored = 1 entry_point = 0x6ce1f82a region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll") Region: id = 432 start_va = 0x70000000 end_va = 0x70007fff monitored = 0 entry_point = 0x700017b0 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 433 start_va = 0x6c150000 end_va = 0x6c800fff monitored = 1 entry_point = 0x6c165d20 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll") Region: id = 434 start_va = 0x420000 end_va = 0x45ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 435 start_va = 0x570000 end_va = 0x66ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000570000" filename = "" Region: id = 436 start_va = 0x6c050000 end_va = 0x6c144fff monitored = 0 entry_point = 0x6c0a4160 region_type = mapped_file name = "msvcr120_clr0400.dll" filename = "\\Windows\\SysWOW64\\msvcr120_clr0400.dll" (normalized: "c:\\windows\\syswow64\\msvcr120_clr0400.dll") Region: id = 437 start_va = 0x1e0000 end_va = 0x1e0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001e0000" filename = "" Region: id = 438 start_va = 0x1f0000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 439 start_va = 0x460000 end_va = 0x46ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000460000" filename = "" Region: id = 440 start_va = 0x470000 end_va = 0x47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000470000" filename = "" Region: id = 441 start_va = 0x480000 end_va = 0x48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000480000" filename = "" Region: id = 442 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 443 start_va = 0x770000 end_va = 0x77ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000770000" filename = "" Region: id = 444 start_va = 0x870000 end_va = 0x87ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000870000" filename = "" Region: id = 445 start_va = 0x780000 end_va = 0x780fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000780000" filename = "" Region: id = 446 start_va = 0x790000 end_va = 0x790fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000790000" filename = "" Region: id = 447 start_va = 0x7a0000 end_va = 0x86ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007a0000" filename = "" Region: id = 448 start_va = 0x2070000 end_va = 0x213ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002070000" filename = "" Region: id = 449 start_va = 0x7a0000 end_va = 0x7dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007a0000" filename = "" Region: id = 450 start_va = 0x860000 end_va = 0x86ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000860000" filename = "" Region: id = 451 start_va = 0x2140000 end_va = 0x223ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002140000" filename = "" Region: id = 452 start_va = 0x7e0000 end_va = 0x7effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007e0000" filename = "" Region: id = 453 start_va = 0x2240000 end_va = 0x423ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002240000" filename = "" Region: id = 454 start_va = 0x880000 end_va = 0x91ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000880000" filename = "" Region: id = 455 start_va = 0x7e0000 end_va = 0x81ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007e0000" filename = "" Region: id = 456 start_va = 0x4240000 end_va = 0x433ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004240000" filename = "" Region: id = 457 start_va = 0x4340000 end_va = 0x4676fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 458 start_va = 0x6a640000 end_va = 0x6b867fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\8062d427acd64e37f4fded7b00f4a869\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\mscorlib\\8062d427acd64e37f4fded7b00f4a869\\mscorlib.ni.dll") Region: id = 459 start_va = 0x75160000 end_va = 0x7524afff monitored = 0 entry_point = 0x7519d650 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 460 start_va = 0x820000 end_va = 0x82ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000820000" filename = "" Region: id = 461 start_va = 0x6bfd0000 end_va = 0x6c04dfff monitored = 1 entry_point = 0x6bfd1140 region_type = mapped_file name = "clrjit.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clrjit.dll") Region: id = 462 start_va = 0x830000 end_va = 0x83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000830000" filename = "" Region: id = 463 start_va = 0x840000 end_va = 0x84ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000840000" filename = "" Region: id = 464 start_va = 0x840000 end_va = 0x84ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000840000" filename = "" Region: id = 465 start_va = 0x69020000 end_va = 0x699cbfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System\\cc4e5d110dd318e8b7d61a9ed184ab74\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system\\cc4e5d110dd318e8b7d61a9ed184ab74\\system.ni.dll") Region: id = 466 start_va = 0x840000 end_va = 0x84ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000840000" filename = "" Region: id = 467 start_va = 0x704d0000 end_va = 0x704e2fff monitored = 0 entry_point = 0x704d9950 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 468 start_va = 0x704a0000 end_va = 0x704cefff monitored = 0 entry_point = 0x704b95e0 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 469 start_va = 0x69f20000 end_va = 0x6a631fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.core.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\abad45b9cc652ba7e38c4c837234c0ab\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.core\\abad45b9cc652ba7e38c4c837234c0ab\\system.core.ni.dll") Region: id = 470 start_va = 0x840000 end_va = 0x84ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000840000" filename = "" Region: id = 471 start_va = 0x840000 end_va = 0x84ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000840000" filename = "" Region: id = 472 start_va = 0x749d0000 end_va = 0x74b47fff monitored = 0 entry_point = 0x74a28a90 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\SysWOW64\\crypt32.dll" (normalized: "c:\\windows\\syswow64\\crypt32.dll") Region: id = 473 start_va = 0x74640000 end_va = 0x7464dfff monitored = 0 entry_point = 0x74645410 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\SysWOW64\\msasn1.dll" (normalized: "c:\\windows\\syswow64\\msasn1.dll") Region: id = 474 start_va = 0x850000 end_va = 0x851fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000850000" filename = "" Region: id = 475 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000920000" filename = "" Region: id = 476 start_va = 0x4680000 end_va = 0x4a7afff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004680000" filename = "" Region: id = 477 start_va = 0x930000 end_va = 0x930fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000930000" filename = "" Region: id = 478 start_va = 0x2070000 end_va = 0x212ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002070000" filename = "" Region: id = 479 start_va = 0x2130000 end_va = 0x213ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002130000" filename = "" Region: id = 480 start_va = 0x2070000 end_va = 0x207ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002070000" filename = "" Region: id = 481 start_va = 0x2120000 end_va = 0x212ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002120000" filename = "" Region: id = 482 start_va = 0x2080000 end_va = 0x208ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002080000" filename = "" Region: id = 483 start_va = 0x6c910000 end_va = 0x6c9fefff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.configuration.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Configuration\\1b51e779650e38bb712f3e535efcf132\\System.Configuration.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.configuration\\1b51e779650e38bb712f3e535efcf132\\system.configuration.ni.dll") Region: id = 484 start_va = 0x68900000 end_va = 0x69015fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.xml.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Xml\\1f87b5140145c221b5201351fffc52d8\\System.Xml.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.xml\\1f87b5140145c221b5201351fffc52d8\\system.xml.ni.dll") Region: id = 485 start_va = 0x761f0000 end_va = 0x7624efff monitored = 0 entry_point = 0x761f4af0 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 486 start_va = 0x72100000 end_va = 0x7214efff monitored = 0 entry_point = 0x7210d850 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\SysWOW64\\mswsock.dll" (normalized: "c:\\windows\\syswow64\\mswsock.dll") Thread: id = 3 os_tid = 0x4d0 [0093.929] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0093.933] RoInitialize () returned 0x1 [0093.933] RoUninitialize () returned 0x0 [0100.737] GetTickCount () returned 0x19ba568 [0101.615] CryptAcquireContextW (in: phProv=0x19f3f8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x19f3f8*=0x732128) returned 1 [0101.632] CryptGetProvParam (in: hProv=0x732128, dwParam=0x1, pbData=0x0, pdwDataLen=0x19f3bc, dwFlags=0x1 | out: pbData=0x0, pdwDataLen=0x19f3bc) returned 1 [0101.633] CoTaskMemAlloc (cb=0x20) returned 0x6bb900 [0101.633] CryptGetProvParam (in: hProv=0x732128, dwParam=0x1, pbData=0x6bb900, pdwDataLen=0x19f3bc, dwFlags=0x1 | out: pbData=0x6bb900, pdwDataLen=0x19f3bc) returned 1 [0101.635] CoTaskMemFree (pv=0x6bb900) [0101.635] CryptGetProvParam (in: hProv=0x732128, dwParam=0x1, pbData=0x0, pdwDataLen=0x19f3bc, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x19f3bc) returned 1 [0101.635] CoTaskMemAlloc (cb=0x20) returned 0x6bb900 [0101.635] CryptGetProvParam (in: hProv=0x732128, dwParam=0x1, pbData=0x6bb900, pdwDataLen=0x19f3bc, dwFlags=0x0 | out: pbData=0x6bb900, pdwDataLen=0x19f3bc) returned 1 [0101.635] CoTaskMemFree (pv=0x6bb900) [0101.635] CryptGetProvParam (in: hProv=0x732128, dwParam=0x1, pbData=0x0, pdwDataLen=0x19f3bc, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x19f3bc) returned 1 [0101.636] CoTaskMemAlloc (cb=0x20) returned 0x6bb900 [0101.636] CryptGetProvParam (in: hProv=0x732128, dwParam=0x1, pbData=0x6bb900, pdwDataLen=0x19f3bc, dwFlags=0x0 | out: pbData=0x6bb900, pdwDataLen=0x19f3bc) returned 1 [0101.636] CoTaskMemFree (pv=0x6bb900) [0101.636] CryptGetProvParam (in: hProv=0x732128, dwParam=0x1, pbData=0x0, pdwDataLen=0x19f3bc, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x19f3bc) returned 1 [0101.636] CoTaskMemAlloc (cb=0x20) returned 0x6bb900 [0101.636] CryptGetProvParam (in: hProv=0x732128, dwParam=0x1, pbData=0x6bb900, pdwDataLen=0x19f3bc, dwFlags=0x0 | out: pbData=0x6bb900, pdwDataLen=0x19f3bc) returned 1 [0101.636] CoTaskMemFree (pv=0x6bb900) [0101.636] CryptGetProvParam (in: hProv=0x732128, dwParam=0x1, pbData=0x0, pdwDataLen=0x19f3bc, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x19f3bc) returned 1 [0101.636] CoTaskMemAlloc (cb=0x20) returned 0x6bb900 [0101.636] CryptGetProvParam (in: hProv=0x732128, dwParam=0x1, pbData=0x6bb900, pdwDataLen=0x19f3bc, dwFlags=0x0 | out: pbData=0x6bb900, pdwDataLen=0x19f3bc) returned 1 [0101.636] CoTaskMemFree (pv=0x6bb900) [0101.636] CryptGetProvParam (in: hProv=0x732128, dwParam=0x1, pbData=0x0, pdwDataLen=0x19f3bc, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x19f3bc) returned 1 [0101.636] CoTaskMemAlloc (cb=0x20) returned 0x6bb900 [0101.636] CryptGetProvParam (in: hProv=0x732128, dwParam=0x1, pbData=0x6bb900, pdwDataLen=0x19f3bc, dwFlags=0x0 | out: pbData=0x6bb900, pdwDataLen=0x19f3bc) returned 1 [0101.636] CoTaskMemFree (pv=0x6bb900) [0101.636] CryptGetProvParam (in: hProv=0x732128, dwParam=0x1, pbData=0x0, pdwDataLen=0x19f3bc, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x19f3bc) returned 1 [0101.636] CoTaskMemAlloc (cb=0x20) returned 0x6bb9a0 [0101.636] CryptGetProvParam (in: hProv=0x732128, dwParam=0x1, pbData=0x6bb9a0, pdwDataLen=0x19f3bc, dwFlags=0x0 | out: pbData=0x6bb9a0, pdwDataLen=0x19f3bc) returned 1 [0101.636] CoTaskMemFree (pv=0x6bb9a0) [0101.636] CryptGetProvParam (in: hProv=0x732128, dwParam=0x1, pbData=0x0, pdwDataLen=0x19f3bc, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x19f3bc) returned 1 [0101.637] CoTaskMemAlloc (cb=0x20) returned 0x6bb900 [0101.637] CryptGetProvParam (in: hProv=0x732128, dwParam=0x1, pbData=0x6bb900, pdwDataLen=0x19f3bc, dwFlags=0x0 | out: pbData=0x6bb900, pdwDataLen=0x19f3bc) returned 1 [0101.637] CoTaskMemFree (pv=0x6bb900) [0101.637] CryptGetProvParam (in: hProv=0x732128, dwParam=0x1, pbData=0x0, pdwDataLen=0x19f3bc, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x19f3bc) returned 1 [0101.637] CoTaskMemAlloc (cb=0x20) returned 0x6bb900 [0101.637] CryptGetProvParam (in: hProv=0x732128, dwParam=0x1, pbData=0x6bb900, pdwDataLen=0x19f3bc, dwFlags=0x0 | out: pbData=0x6bb900, pdwDataLen=0x19f3bc) returned 1 [0101.637] CoTaskMemFree (pv=0x6bb900) [0101.637] CryptGetProvParam (in: hProv=0x732128, dwParam=0x1, pbData=0x0, pdwDataLen=0x19f3bc, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x19f3bc) returned 1 [0101.637] CoTaskMemAlloc (cb=0x20) returned 0x6bb900 [0101.637] CryptGetProvParam (in: hProv=0x732128, dwParam=0x1, pbData=0x6bb900, pdwDataLen=0x19f3bc, dwFlags=0x0 | out: pbData=0x6bb900, pdwDataLen=0x19f3bc) returned 1 [0101.637] CoTaskMemFree (pv=0x6bb900) [0101.637] CryptGetProvParam (in: hProv=0x732128, dwParam=0x1, pbData=0x0, pdwDataLen=0x19f3bc, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x19f3bc) returned 1 [0101.637] CoTaskMemAlloc (cb=0x20) returned 0x6bb900 [0101.637] CryptGetProvParam (in: hProv=0x732128, dwParam=0x1, pbData=0x6bb900, pdwDataLen=0x19f3bc, dwFlags=0x0 | out: pbData=0x6bb900, pdwDataLen=0x19f3bc) returned 1 [0101.637] CoTaskMemFree (pv=0x6bb900) [0101.637] CryptGetProvParam (in: hProv=0x732128, dwParam=0x1, pbData=0x0, pdwDataLen=0x19f3bc, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x19f3bc) returned 1 [0101.637] CoTaskMemAlloc (cb=0x20) returned 0x6bb900 [0101.637] CryptGetProvParam (in: hProv=0x732128, dwParam=0x1, pbData=0x6bb900, pdwDataLen=0x19f3bc, dwFlags=0x0 | out: pbData=0x6bb900, pdwDataLen=0x19f3bc) returned 1 [0101.637] CoTaskMemFree (pv=0x6bb900) [0101.637] CryptGetProvParam (in: hProv=0x732128, dwParam=0x1, pbData=0x0, pdwDataLen=0x19f3bc, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x19f3bc) returned 1 [0101.637] CoTaskMemAlloc (cb=0x20) returned 0x6bb9a0 [0101.637] CryptGetProvParam (in: hProv=0x732128, dwParam=0x1, pbData=0x6bb9a0, pdwDataLen=0x19f3bc, dwFlags=0x0 | out: pbData=0x6bb9a0, pdwDataLen=0x19f3bc) returned 1 [0101.637] CoTaskMemFree (pv=0x6bb9a0) [0101.638] CryptGetProvParam (in: hProv=0x732128, dwParam=0x1, pbData=0x0, pdwDataLen=0x19f3bc, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x19f3bc) returned 1 [0101.638] CoTaskMemAlloc (cb=0x20) returned 0x6bb900 [0101.638] CryptGetProvParam (in: hProv=0x732128, dwParam=0x1, pbData=0x6bb900, pdwDataLen=0x19f3bc, dwFlags=0x0 | out: pbData=0x6bb900, pdwDataLen=0x19f3bc) returned 1 [0101.638] CoTaskMemFree (pv=0x6bb900) [0101.638] CryptGetProvParam (in: hProv=0x732128, dwParam=0x1, pbData=0x0, pdwDataLen=0x19f3bc, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x19f3bc) returned 1 [0101.638] CoTaskMemAlloc (cb=0x20) returned 0x6bb900 [0101.638] CryptGetProvParam (in: hProv=0x732128, dwParam=0x1, pbData=0x6bb900, pdwDataLen=0x19f3bc, dwFlags=0x0 | out: pbData=0x6bb900, pdwDataLen=0x19f3bc) returned 1 [0101.638] CoTaskMemFree (pv=0x6bb900) [0101.638] CryptGetProvParam (in: hProv=0x732128, dwParam=0x1, pbData=0x0, pdwDataLen=0x19f3bc, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x19f3bc) returned 1 [0101.638] CoTaskMemAlloc (cb=0x20) returned 0x6bb900 [0101.638] CryptGetProvParam (in: hProv=0x732128, dwParam=0x1, pbData=0x6bb900, pdwDataLen=0x19f3bc, dwFlags=0x0 | out: pbData=0x6bb900, pdwDataLen=0x19f3bc) returned 1 [0101.638] CoTaskMemFree (pv=0x6bb900) [0101.638] CryptGetProvParam (in: hProv=0x732128, dwParam=0x1, pbData=0x0, pdwDataLen=0x19f3bc, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x19f3bc) returned 1 [0101.638] CoTaskMemAlloc (cb=0x20) returned 0x6bb9a0 [0101.638] CryptGetProvParam (in: hProv=0x732128, dwParam=0x1, pbData=0x6bb9a0, pdwDataLen=0x19f3bc, dwFlags=0x0 | out: pbData=0x6bb9a0, pdwDataLen=0x19f3bc) returned 1 [0101.638] CoTaskMemFree (pv=0x6bb9a0) [0101.638] CryptGetProvParam (in: hProv=0x732128, dwParam=0x1, pbData=0x0, pdwDataLen=0x19f3bc, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x19f3bc) returned 1 [0101.639] CoTaskMemAlloc (cb=0x20) returned 0x6bb900 [0101.639] CryptGetProvParam (in: hProv=0x732128, dwParam=0x1, pbData=0x6bb900, pdwDataLen=0x19f3bc, dwFlags=0x0 | out: pbData=0x6bb900, pdwDataLen=0x19f3bc) returned 1 [0101.639] CoTaskMemFree (pv=0x6bb900) [0101.640] CryptGetProvParam (in: hProv=0x732128, dwParam=0x1, pbData=0x0, pdwDataLen=0x19f3bc, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x19f3bc) returned 1 [0101.640] CoTaskMemAlloc (cb=0x20) returned 0x6bb9a0 [0101.640] CryptGetProvParam (in: hProv=0x732128, dwParam=0x1, pbData=0x6bb9a0, pdwDataLen=0x19f3bc, dwFlags=0x0 | out: pbData=0x6bb9a0, pdwDataLen=0x19f3bc) returned 1 [0101.640] CoTaskMemFree (pv=0x6bb9a0) [0101.640] CryptGetProvParam (in: hProv=0x732128, dwParam=0x1, pbData=0x0, pdwDataLen=0x19f3bc, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x19f3bc) returned 1 [0101.640] CoTaskMemAlloc (cb=0x20) returned 0x6bb900 [0101.640] CryptGetProvParam (in: hProv=0x732128, dwParam=0x1, pbData=0x6bb900, pdwDataLen=0x19f3bc, dwFlags=0x0 | out: pbData=0x6bb900, pdwDataLen=0x19f3bc) returned 1 [0101.640] CoTaskMemFree (pv=0x6bb900) [0101.640] CryptGetProvParam (in: hProv=0x732128, dwParam=0x1, pbData=0x0, pdwDataLen=0x19f3bc, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x19f3bc) returned 0 [0101.645] CryptImportKey (in: hProv=0x732128, pbData=0x2318158, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x1, phKey=0x19f3c8 | out: phKey=0x19f3c8*=0x6b3558) returned 1 [0101.646] CryptContextAddRef (hProv=0x732128, pdwReserved=0x0, dwFlags=0x0) returned 1 [0101.658] BCryptGetFipsAlgorithmMode (in: pfEnabled=0x19f3e8 | out: pfEnabled=0x19f3e8) returned 0x0 [0101.672] CryptContextAddRef (hProv=0x732128, pdwReserved=0x0, dwFlags=0x0) returned 1 [0101.672] CryptDuplicateKey (in: hKey=0x6b3558, pdwReserved=0x0, dwFlags=0x0, phKey=0x19f3b8 | out: phKey=0x19f3b8*=0x6b3b18) returned 1 [0101.672] CryptContextAddRef (hProv=0x732128, pdwReserved=0x0, dwFlags=0x0) returned 1 [0101.672] CryptSetKeyParam (hKey=0x6b3b18, dwParam=0x4, pbData=0x2318b38*=0x1, dwFlags=0x0) returned 1 [0101.672] CryptSetKeyParam (hKey=0x6b3b18, dwParam=0x1, pbData=0x2318b04, dwFlags=0x0) returned 1 [0101.675] CryptDecrypt (in: hKey=0x6b3b18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2318c18, pdwDataLen=0x19f3f8 | out: pbData=0x2318c18, pdwDataLen=0x19f3f8) returned 1 [0101.676] CryptDecrypt (in: hKey=0x6b3b18, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2318c5c, pdwDataLen=0x19f3f8 | out: pbData=0x2318c5c, pdwDataLen=0x19f3f8) returned 0 [0101.677] CryptDestroyKey (hKey=0x6b3558) returned 1 [0101.677] CryptReleaseContext (hProv=0x732128, dwFlags=0x0) returned 1 [0101.677] CryptReleaseContext (hProv=0x732128, dwFlags=0x0) returned 1 [0101.677] CryptAcquireContextW (in: phProv=0x19f3f8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x19f3f8*=0x7325f0) returned 1 [0101.678] CryptImportKey (in: hProv=0x7325f0, pbData=0x2318dc8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x1, phKey=0x19f3c8 | out: phKey=0x19f3c8*=0x6b3558) returned 1 [0101.678] CryptContextAddRef (hProv=0x7325f0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0101.679] CryptContextAddRef (hProv=0x7325f0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0101.679] CryptDuplicateKey (in: hKey=0x6b3558, pdwReserved=0x0, dwFlags=0x0, phKey=0x19f3b8 | out: phKey=0x19f3b8*=0x6b3f18) returned 1 [0101.679] CryptContextAddRef (hProv=0x7325f0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0101.679] CryptSetKeyParam (hKey=0x6b3f18, dwParam=0x4, pbData=0x2319538*=0x1, dwFlags=0x0) returned 1 [0101.679] CryptSetKeyParam (hKey=0x6b3f18, dwParam=0x1, pbData=0x2319504, dwFlags=0x0) returned 1 [0101.679] CryptDecrypt (in: hKey=0x6b3f18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2319618, pdwDataLen=0x19f3f8 | out: pbData=0x2319618, pdwDataLen=0x19f3f8) returned 1 [0101.679] CryptDecrypt (in: hKey=0x6b3f18, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2319668, pdwDataLen=0x19f3f8 | out: pbData=0x2319668, pdwDataLen=0x19f3f8) returned 0 [0101.680] CryptDestroyKey (hKey=0x6b3558) returned 1 [0101.680] CryptReleaseContext (hProv=0x7325f0, dwFlags=0x0) returned 1 [0101.680] CryptReleaseContext (hProv=0x7325f0, dwFlags=0x0) returned 1 [0101.680] CryptAcquireContextW (in: phProv=0x19f3f8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x19f3f8*=0x731ce8) returned 1 [0101.681] CryptImportKey (in: hProv=0x731ce8, pbData=0x23197f4, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x1, phKey=0x19f3c8 | out: phKey=0x19f3c8*=0x6b3558) returned 1 [0101.681] CryptContextAddRef (hProv=0x731ce8, pdwReserved=0x0, dwFlags=0x0) returned 1 [0101.681] CryptContextAddRef (hProv=0x731ce8, pdwReserved=0x0, dwFlags=0x0) returned 1 [0101.681] CryptDuplicateKey (in: hKey=0x6b3558, pdwReserved=0x0, dwFlags=0x0, phKey=0x19f3b8 | out: phKey=0x19f3b8*=0x6b3e58) returned 1 [0101.681] CryptContextAddRef (hProv=0x731ce8, pdwReserved=0x0, dwFlags=0x0) returned 1 [0101.681] CryptSetKeyParam (hKey=0x6b3e58, dwParam=0x4, pbData=0x2319f64*=0x1, dwFlags=0x0) returned 1 [0101.681] CryptSetKeyParam (hKey=0x6b3e58, dwParam=0x1, pbData=0x2319f30, dwFlags=0x0) returned 1 [0101.681] CryptDecrypt (in: hKey=0x6b3e58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x231a044, pdwDataLen=0x19f3f8 | out: pbData=0x231a044, pdwDataLen=0x19f3f8) returned 1 [0101.682] CryptDecrypt (in: hKey=0x6b3e58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x231a08c, pdwDataLen=0x19f3f8 | out: pbData=0x231a08c, pdwDataLen=0x19f3f8) returned 0 [0101.682] CryptDestroyKey (hKey=0x6b3558) returned 1 [0101.682] CryptReleaseContext (hProv=0x731ce8, dwFlags=0x0) returned 1 [0101.682] CryptReleaseContext (hProv=0x731ce8, dwFlags=0x0) returned 1 [0101.682] CryptAcquireContextW (in: phProv=0x19f3f8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x19f3f8*=0x7329a8) returned 1 [0101.682] CryptImportKey (in: hProv=0x7329a8, pbData=0x231a200, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x1, phKey=0x19f3c8 | out: phKey=0x19f3c8*=0x6b3558) returned 1 [0101.682] CryptContextAddRef (hProv=0x7329a8, pdwReserved=0x0, dwFlags=0x0) returned 1 [0101.683] CryptContextAddRef (hProv=0x7329a8, pdwReserved=0x0, dwFlags=0x0) returned 1 [0101.683] CryptDuplicateKey (in: hKey=0x6b3558, pdwReserved=0x0, dwFlags=0x0, phKey=0x19f3b8 | out: phKey=0x19f3b8*=0x6b3ad8) returned 1 [0101.683] CryptContextAddRef (hProv=0x7329a8, pdwReserved=0x0, dwFlags=0x0) returned 1 [0101.683] CryptSetKeyParam (hKey=0x6b3ad8, dwParam=0x4, pbData=0x231a970*=0x1, dwFlags=0x0) returned 1 [0101.683] CryptSetKeyParam (hKey=0x6b3ad8, dwParam=0x1, pbData=0x231a93c, dwFlags=0x0) returned 1 [0101.683] CryptDecrypt (in: hKey=0x6b3ad8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x231aa50, pdwDataLen=0x19f3f8 | out: pbData=0x231aa50, pdwDataLen=0x19f3f8) returned 1 [0101.683] CryptDecrypt (in: hKey=0x6b3ad8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x231aa98, pdwDataLen=0x19f3f8 | out: pbData=0x231aa98, pdwDataLen=0x19f3f8) returned 0 [0101.684] CryptDestroyKey (hKey=0x6b3558) returned 1 [0101.684] CryptReleaseContext (hProv=0x7329a8, dwFlags=0x0) returned 1 [0101.684] CryptReleaseContext (hProv=0x7329a8, dwFlags=0x0) returned 1 [0101.684] CryptAcquireContextW (in: phProv=0x19f3f8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x19f3f8*=0x7321b0) returned 1 [0101.684] CryptImportKey (in: hProv=0x7321b0, pbData=0x231ac08, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x1, phKey=0x19f3c8 | out: phKey=0x19f3c8*=0x6b3558) returned 1 [0101.684] CryptContextAddRef (hProv=0x7321b0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0101.685] CryptContextAddRef (hProv=0x7321b0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0101.685] CryptDuplicateKey (in: hKey=0x6b3558, pdwReserved=0x0, dwFlags=0x0, phKey=0x19f3b8 | out: phKey=0x19f3b8*=0x6b3a58) returned 1 [0101.685] CryptContextAddRef (hProv=0x7321b0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0101.685] CryptSetKeyParam (hKey=0x6b3a58, dwParam=0x4, pbData=0x231b378*=0x1, dwFlags=0x0) returned 1 [0101.685] CryptSetKeyParam (hKey=0x6b3a58, dwParam=0x1, pbData=0x231b344, dwFlags=0x0) returned 1 [0101.685] CryptDecrypt (in: hKey=0x6b3a58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x231b458, pdwDataLen=0x19f3f8 | out: pbData=0x231b458, pdwDataLen=0x19f3f8) returned 1 [0101.685] CryptDecrypt (in: hKey=0x6b3a58, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x231b4a8, pdwDataLen=0x19f3f8 | out: pbData=0x231b4a8, pdwDataLen=0x19f3f8) returned 0 [0101.685] CryptDestroyKey (hKey=0x6b3558) returned 1 [0101.685] CryptReleaseContext (hProv=0x7321b0, dwFlags=0x0) returned 1 [0101.685] CryptReleaseContext (hProv=0x7321b0, dwFlags=0x0) returned 1 [0101.685] CryptAcquireContextW (in: phProv=0x19f3f8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x19f3f8*=0x732788) returned 1 [0101.686] CryptImportKey (in: hProv=0x732788, pbData=0x231b630, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x1, phKey=0x19f3c8 | out: phKey=0x19f3c8*=0x6b3558) returned 1 [0101.686] CryptContextAddRef (hProv=0x732788, pdwReserved=0x0, dwFlags=0x0) returned 1 [0101.686] CryptContextAddRef (hProv=0x732788, pdwReserved=0x0, dwFlags=0x0) returned 1 [0101.686] CryptDuplicateKey (in: hKey=0x6b3558, pdwReserved=0x0, dwFlags=0x0, phKey=0x19f3b8 | out: phKey=0x19f3b8*=0x6b3bd8) returned 1 [0101.686] CryptContextAddRef (hProv=0x732788, pdwReserved=0x0, dwFlags=0x0) returned 1 [0101.686] CryptSetKeyParam (hKey=0x6b3bd8, dwParam=0x4, pbData=0x231bda0*=0x1, dwFlags=0x0) returned 1 [0101.687] CryptSetKeyParam (hKey=0x6b3bd8, dwParam=0x1, pbData=0x231bd6c, dwFlags=0x0) returned 1 [0101.687] CryptDecrypt (in: hKey=0x6b3bd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x231be80, pdwDataLen=0x19f3f8 | out: pbData=0x231be80, pdwDataLen=0x19f3f8) returned 1 [0101.687] CryptDecrypt (in: hKey=0x6b3bd8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x231bec4, pdwDataLen=0x19f3f8 | out: pbData=0x231bec4, pdwDataLen=0x19f3f8) returned 0 [0101.687] CryptDestroyKey (hKey=0x6b3558) returned 1 [0101.687] CryptReleaseContext (hProv=0x732788, dwFlags=0x0) returned 1 [0101.687] CryptReleaseContext (hProv=0x732788, dwFlags=0x0) returned 1 [0101.687] CryptAcquireContextW (in: phProv=0x19f3f8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x19f3f8*=0x732810) returned 1 [0101.688] CryptImportKey (in: hProv=0x732810, pbData=0x231c030, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x1, phKey=0x19f3c8 | out: phKey=0x19f3c8*=0x6b3558) returned 1 [0101.688] CryptContextAddRef (hProv=0x732810, pdwReserved=0x0, dwFlags=0x0) returned 1 [0101.688] CryptContextAddRef (hProv=0x732810, pdwReserved=0x0, dwFlags=0x0) returned 1 [0101.688] CryptDuplicateKey (in: hKey=0x6b3558, pdwReserved=0x0, dwFlags=0x0, phKey=0x19f3b8 | out: phKey=0x19f3b8*=0x6b39d8) returned 1 [0101.688] CryptContextAddRef (hProv=0x732810, pdwReserved=0x0, dwFlags=0x0) returned 1 [0101.688] CryptSetKeyParam (hKey=0x6b39d8, dwParam=0x4, pbData=0x231c7a0*=0x1, dwFlags=0x0) returned 1 [0101.688] CryptSetKeyParam (hKey=0x6b39d8, dwParam=0x1, pbData=0x231c76c, dwFlags=0x0) returned 1 [0101.688] CryptDecrypt (in: hKey=0x6b39d8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x231c880, pdwDataLen=0x19f3f8 | out: pbData=0x231c880, pdwDataLen=0x19f3f8) returned 1 [0101.688] CryptDecrypt (in: hKey=0x6b39d8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x231c8c8, pdwDataLen=0x19f3f8 | out: pbData=0x231c8c8, pdwDataLen=0x19f3f8) returned 0 [0101.689] CryptDestroyKey (hKey=0x6b3558) returned 1 [0101.689] CryptReleaseContext (hProv=0x732810, dwFlags=0x0) returned 1 [0101.689] CryptReleaseContext (hProv=0x732810, dwFlags=0x0) returned 1 [0101.689] CryptAcquireContextW (in: phProv=0x19f3f8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x19f3f8*=0x732238) returned 1 [0101.689] CryptImportKey (in: hProv=0x732238, pbData=0x231ca38, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x1, phKey=0x19f3c8 | out: phKey=0x19f3c8*=0x6b3558) returned 1 [0101.689] CryptContextAddRef (hProv=0x732238, pdwReserved=0x0, dwFlags=0x0) returned 1 [0101.690] CryptContextAddRef (hProv=0x732238, pdwReserved=0x0, dwFlags=0x0) returned 1 [0101.690] CryptDuplicateKey (in: hKey=0x6b3558, pdwReserved=0x0, dwFlags=0x0, phKey=0x19f3b8 | out: phKey=0x19f3b8*=0x6b4058) returned 1 [0101.690] CryptContextAddRef (hProv=0x732238, pdwReserved=0x0, dwFlags=0x0) returned 1 [0101.690] CryptSetKeyParam (hKey=0x6b4058, dwParam=0x4, pbData=0x231d1a8*=0x1, dwFlags=0x0) returned 1 [0101.690] CryptSetKeyParam (hKey=0x6b4058, dwParam=0x1, pbData=0x231d174, dwFlags=0x0) returned 1 [0101.690] CryptDecrypt (in: hKey=0x6b4058, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x231d288, pdwDataLen=0x19f3f8 | out: pbData=0x231d288, pdwDataLen=0x19f3f8) returned 1 [0101.690] CryptDecrypt (in: hKey=0x6b4058, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x231d2d0, pdwDataLen=0x19f3f8 | out: pbData=0x231d2d0, pdwDataLen=0x19f3f8) returned 0 [0101.690] CryptDestroyKey (hKey=0x6b3558) returned 1 [0101.690] CryptReleaseContext (hProv=0x732238, dwFlags=0x0) returned 1 [0101.690] CryptReleaseContext (hProv=0x732238, dwFlags=0x0) returned 1 [0101.690] CryptAcquireContextW (in: phProv=0x19f3f8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x19f3f8*=0x732b40) returned 1 [0101.691] CryptImportKey (in: hProv=0x732b40, pbData=0x231d440, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x1, phKey=0x19f3c8 | out: phKey=0x19f3c8*=0x6b3558) returned 1 [0101.691] CryptContextAddRef (hProv=0x732b40, pdwReserved=0x0, dwFlags=0x0) returned 1 [0101.691] CryptContextAddRef (hProv=0x732b40, pdwReserved=0x0, dwFlags=0x0) returned 1 [0101.692] CryptDuplicateKey (in: hKey=0x6b3558, pdwReserved=0x0, dwFlags=0x0, phKey=0x19f3b8 | out: phKey=0x19f3b8*=0x6b3d98) returned 1 [0101.692] CryptContextAddRef (hProv=0x732b40, pdwReserved=0x0, dwFlags=0x0) returned 1 [0101.692] CryptSetKeyParam (hKey=0x6b3d98, dwParam=0x4, pbData=0x231dbb0*=0x1, dwFlags=0x0) returned 1 [0101.692] CryptSetKeyParam (hKey=0x6b3d98, dwParam=0x1, pbData=0x231db7c, dwFlags=0x0) returned 1 [0101.692] CryptDecrypt (in: hKey=0x6b3d98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x231dc90, pdwDataLen=0x19f3f8 | out: pbData=0x231dc90, pdwDataLen=0x19f3f8) returned 1 [0101.692] CryptDecrypt (in: hKey=0x6b3d98, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x231dcd4, pdwDataLen=0x19f3f8 | out: pbData=0x231dcd4, pdwDataLen=0x19f3f8) returned 0 [0101.692] CryptDestroyKey (hKey=0x6b3558) returned 1 [0101.692] CryptReleaseContext (hProv=0x732b40, dwFlags=0x0) returned 1 [0101.692] CryptReleaseContext (hProv=0x732b40, dwFlags=0x0) returned 1 [0101.715] GetUserNameW (in: lpBuffer=0x19f20c, pcbBuffer=0x19f484 | out: lpBuffer="RDhJ0CNFevzX", pcbBuffer=0x19f484) returned 1 [0101.722] GetComputerNameW (in: lpBuffer=0x19f20c, nSize=0x19f484 | out: lpBuffer="XC64ZB", nSize=0x19f484) returned 1 [0101.722] CoTaskMemAlloc (cb=0x20c) returned 0x7358c0 [0101.722] GetSystemDirectoryW (in: lpBuffer=0x7358c0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0101.722] CoTaskMemFree (pv=0x7358c0) [0101.725] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x19eee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0101.728] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x19eee8, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0101.729] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f440) returned 1 [0101.730] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\", lpFreeBytesAvailableToCaller=0x19f46c, lpTotalNumberOfBytes=0x19f464, lpTotalNumberOfFreeBytes=0x19f45c | out: lpFreeBytesAvailableToCaller=0x19f46c, lpTotalNumberOfBytes=0x19f464, lpTotalNumberOfFreeBytes=0x19f45c) returned 1 [0101.730] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f43c) returned 1 [0101.764] CryptAcquireContextW (in: phProv=0x19f3f8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x19f3f8*=0x7320a0) returned 1 [0101.765] CryptImportKey (in: hProv=0x7320a0, pbData=0x231fe50, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x1, phKey=0x19f3c8 | out: phKey=0x19f3c8*=0x6b3cd8) returned 1 [0101.765] CryptContextAddRef (hProv=0x7320a0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0101.765] CryptContextAddRef (hProv=0x7320a0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0101.766] CryptDuplicateKey (in: hKey=0x6b3cd8, pdwReserved=0x0, dwFlags=0x0, phKey=0x19f3b8 | out: phKey=0x19f3b8*=0x6b3dd8) returned 1 [0101.766] CryptContextAddRef (hProv=0x7320a0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0101.766] CryptSetKeyParam (hKey=0x6b3dd8, dwParam=0x4, pbData=0x2320b20*=0x1, dwFlags=0x0) returned 1 [0101.766] CryptSetKeyParam (hKey=0x6b3dd8, dwParam=0x1, pbData=0x2320aec, dwFlags=0x0) returned 1 [0101.766] CryptDecrypt (in: hKey=0x6b3dd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2321124, pdwDataLen=0x19f3c8 | out: pbData=0x2321124, pdwDataLen=0x19f3c8) returned 1 [0101.766] CryptDecrypt (in: hKey=0x6b3dd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2321414, pdwDataLen=0x19f3f8 | out: pbData=0x2321414, pdwDataLen=0x19f3f8) returned 1 [0101.766] CryptDecrypt (in: hKey=0x6b3dd8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2321460, pdwDataLen=0x19f3f8 | out: pbData=0x2321460, pdwDataLen=0x19f3f8) returned 0 [0101.766] CryptDestroyKey (hKey=0x6b3cd8) returned 1 [0101.766] CryptReleaseContext (hProv=0x7320a0, dwFlags=0x0) returned 1 [0101.766] CryptReleaseContext (hProv=0x7320a0, dwFlags=0x0) returned 1 [0101.766] CryptAcquireContextW (in: phProv=0x19f3f8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x19f3f8*=0x732700) returned 1 [0101.767] CryptImportKey (in: hProv=0x732700, pbData=0x23224b4, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x1, phKey=0x19f3c8 | out: phKey=0x19f3c8*=0x6b4098) returned 1 [0101.767] CryptContextAddRef (hProv=0x732700, pdwReserved=0x0, dwFlags=0x0) returned 1 [0101.768] CryptContextAddRef (hProv=0x732700, pdwReserved=0x0, dwFlags=0x0) returned 1 [0101.768] CryptDuplicateKey (in: hKey=0x6b4098, pdwReserved=0x0, dwFlags=0x0, phKey=0x19f3b8 | out: phKey=0x19f3b8*=0x6b3cd8) returned 1 [0101.768] CryptContextAddRef (hProv=0x732700, pdwReserved=0x0, dwFlags=0x0) returned 1 [0101.768] CryptSetKeyParam (hKey=0x6b3cd8, dwParam=0x4, pbData=0x2323924*=0x1, dwFlags=0x0) returned 1 [0101.768] CryptSetKeyParam (hKey=0x6b3cd8, dwParam=0x1, pbData=0x23238f0, dwFlags=0x0) returned 1 [0101.769] CryptDecrypt (in: hKey=0x6b3cd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x23246e8, pdwDataLen=0x19f3c8 | out: pbData=0x23246e8, pdwDataLen=0x19f3c8) returned 1 [0101.769] CryptDecrypt (in: hKey=0x6b3cd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2324db8, pdwDataLen=0x19f3f8 | out: pbData=0x2324db8, pdwDataLen=0x19f3f8) returned 1 [0101.769] CryptDecrypt (in: hKey=0x6b3cd8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2324df8, pdwDataLen=0x19f3f8 | out: pbData=0x2324df8, pdwDataLen=0x19f3f8) returned 0 [0101.769] CryptDestroyKey (hKey=0x6b4098) returned 1 [0101.769] CryptReleaseContext (hProv=0x732700, dwFlags=0x0) returned 1 [0101.769] CryptReleaseContext (hProv=0x732700, dwFlags=0x0) returned 1 [0102.448] CertDuplicateCertificateContext (pCertContext=0x6c31e0) returned 0x6c31e0 [0102.506] LocalAlloc (uFlags=0x0, uBytes=0x2a) returned 0x738840 [0102.528] CryptFindOIDInfo (dwKeyType=0x2, pvKey=0x738840, dwGroupId=0x3) returned 0x0 [0102.540] LocalFree (hMem=0x738840) returned 0x0 [0102.540] LocalAlloc (uFlags=0x0, uBytes=0x2a) returned 0x6cc158 [0102.540] CryptFindOIDInfo (dwKeyType=0x2, pvKey=0x6cc158, dwGroupId=0x0) returned 0x0 [0102.544] LocalFree (hMem=0x6cc158) returned 0x0 [0102.546] LocalAlloc (uFlags=0x0, uBytes=0x15) returned 0x73ac88 [0102.546] CryptFindOIDInfo (dwKeyType=0x1, pvKey=0x73ac88, dwGroupId=0x0) returned 0x749dd6c0 [0102.557] CryptDecodeObject (in: dwCertEncodingType=0x10001, lpszStructType=0x13, pbEncoded=0x2326fcc, cbEncoded=0x20e, dwFlags=0x0, pvStructInfo=0x0, pcbStructInfo=0x19f434 | out: pvStructInfo=0x0, pcbStructInfo=0x19f434) returned 1 [0102.557] LocalAlloc (uFlags=0x0, uBytes=0x214) returned 0x737720 [0102.557] CryptDecodeObject (in: dwCertEncodingType=0x10001, lpszStructType=0x13, pbEncoded=0x2326fcc, cbEncoded=0x20e, dwFlags=0x0, pvStructInfo=0x737720, pcbStructInfo=0x19f434 | out: pvStructInfo=0x737720, pcbStructInfo=0x19f434) returned 1 [0102.558] LocalFree (hMem=0x737720) returned 0x0 [0102.591] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", nBufferLength=0x105, lpBuffer=0x19edf4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", lpFilePart=0x0) returned 0x43 [0102.593] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", nBufferLength=0x105, lpBuffer=0x19ee5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", lpFilePart=0x0) returned 0x43 [0102.593] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f2bc) returned 1 [0102.593] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x19f338 | out: lpFileInformation=0x19f338*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56a29ff, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97df7583, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97df7583, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1 [0102.593] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f2b8) returned 1 [0102.666] CoTaskMemAlloc (cb=0x2e) returned 0x6cc4a0 [0102.671] CryptFindOIDInfo (dwKeyType=0x2, pvKey=0x6cc4a0, dwGroupId=0x1) returned 0x0 [0102.671] CryptFindOIDInfo (dwKeyType=0x2, pvKey=0x6cc4a0, dwGroupId=0x0) returned 0x0 [0102.671] CoTaskMemFree (pv=0x6cc4a0) [0102.687] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="df4Rtg34dFjwr") returned 0x324 [0102.710] SetThreadExecutionState (esFlags=0x80000003) returned 0x80000000 [0103.149] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe.Config", nBufferLength=0x105, lpBuffer=0x19ed80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe.Config", lpFilePart=0x0) returned 0x3f [0103.149] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe.Config", nBufferLength=0x105, lpBuffer=0x19ed28, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe.Config", lpFilePart=0x0) returned 0x3f [0103.504] GetCurrentProcess () returned 0xffffffff [0103.505] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19f0e0 | out: TokenHandle=0x19f0e0*=0x328) returned 1 [0103.509] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", nBufferLength=0x105, lpBuffer=0x19ebbc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpFilePart=0x0) returned 0x2e [0103.511] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x19f0e0 | out: lpFileInformation=0x19f0e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56a29ff, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97df7583, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97df7583, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1 [0103.512] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x19eb88, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43 [0103.512] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x19f0e0 | out: lpFileInformation=0x19f0e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56a29ff, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97df7583, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97df7583, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1 [0103.512] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x19eb18, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43 [0103.513] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f00c) returned 1 [0103.513] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x334 [0103.513] GetFileType (hFile=0x334) returned 0x1 [0103.513] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f008) returned 1 [0103.513] GetFileType (hFile=0x334) returned 0x1 [0103.635] GetFileSize (in: hFile=0x334, lpFileSizeHigh=0x19f0d4 | out: lpFileSizeHigh=0x19f0d4*=0x0) returned 0x8c8f [0103.635] ReadFile (in: hFile=0x334, lpBuffer=0x234b5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f090, lpOverlapped=0x0 | out: lpBuffer=0x234b5e0*, lpNumberOfBytesRead=0x19f090*=0x1000, lpOverlapped=0x0) returned 1 [0103.657] ReadFile (in: hFile=0x334, lpBuffer=0x234b5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ef2c, lpOverlapped=0x0 | out: lpBuffer=0x234b5e0*, lpNumberOfBytesRead=0x19ef2c*=0x1000, lpOverlapped=0x0) returned 1 [0103.662] ReadFile (in: hFile=0x334, lpBuffer=0x234b5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ede0, lpOverlapped=0x0 | out: lpBuffer=0x234b5e0*, lpNumberOfBytesRead=0x19ede0*=0x1000, lpOverlapped=0x0) returned 1 [0103.662] ReadFile (in: hFile=0x334, lpBuffer=0x234b5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ede0, lpOverlapped=0x0 | out: lpBuffer=0x234b5e0*, lpNumberOfBytesRead=0x19ede0*=0x1000, lpOverlapped=0x0) returned 1 [0103.662] ReadFile (in: hFile=0x334, lpBuffer=0x234b5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ede0, lpOverlapped=0x0 | out: lpBuffer=0x234b5e0*, lpNumberOfBytesRead=0x19ede0*=0x1000, lpOverlapped=0x0) returned 1 [0103.663] ReadFile (in: hFile=0x334, lpBuffer=0x234b5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ed18, lpOverlapped=0x0 | out: lpBuffer=0x234b5e0*, lpNumberOfBytesRead=0x19ed18*=0x1000, lpOverlapped=0x0) returned 1 [0103.666] ReadFile (in: hFile=0x334, lpBuffer=0x234b5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ee94, lpOverlapped=0x0 | out: lpBuffer=0x234b5e0*, lpNumberOfBytesRead=0x19ee94*=0x1000, lpOverlapped=0x0) returned 1 [0103.674] ReadFile (in: hFile=0x334, lpBuffer=0x234b5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19eda8, lpOverlapped=0x0 | out: lpBuffer=0x234b5e0*, lpNumberOfBytesRead=0x19eda8*=0x1000, lpOverlapped=0x0) returned 1 [0103.675] ReadFile (in: hFile=0x334, lpBuffer=0x234b5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19eda8, lpOverlapped=0x0 | out: lpBuffer=0x234b5e0*, lpNumberOfBytesRead=0x19eda8*=0xc8f, lpOverlapped=0x0) returned 1 [0103.675] ReadFile (in: hFile=0x334, lpBuffer=0x234b5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ee68, lpOverlapped=0x0 | out: lpBuffer=0x234b5e0*, lpNumberOfBytesRead=0x19ee68*=0x0, lpOverlapped=0x0) returned 1 [0103.675] CloseHandle (hObject=0x334) returned 1 [0103.676] GetCurrentProcess () returned 0xffffffff [0103.676] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19f208 | out: TokenHandle=0x19f208*=0x334) returned 1 [0103.677] GetCurrentProcess () returned 0xffffffff [0103.677] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19f208 | out: TokenHandle=0x19f208*=0x338) returned 1 [0103.678] GetCurrentProcess () returned 0xffffffff [0103.678] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19f0e0 | out: TokenHandle=0x19f0e0*=0x33c) returned 1 [0103.678] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe.Config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\regasm.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x19f0e0 | out: lpFileInformation=0x19f0e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x503a4f7, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97b228e4, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97b228e4, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x119)) returned 1 [0103.678] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe.Config", nBufferLength=0x105, lpBuffer=0x19eb88, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe.Config", lpFilePart=0x0) returned 0x3f [0103.678] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe.Config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\regasm.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x19f0e0 | out: lpFileInformation=0x19f0e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x503a4f7, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97b228e4, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97b228e4, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x119)) returned 1 [0103.678] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe.Config", nBufferLength=0x105, lpBuffer=0x19eb18, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe.Config", lpFilePart=0x0) returned 0x3f [0103.678] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f00c) returned 1 [0103.678] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe.Config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\regasm.exe.config"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x340 [0103.679] GetFileType (hFile=0x340) returned 0x1 [0103.679] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f008) returned 1 [0103.679] GetFileType (hFile=0x340) returned 0x1 [0103.679] GetFileSize (in: hFile=0x340, lpFileSizeHigh=0x19f0d4 | out: lpFileSizeHigh=0x19f0d4*=0x0) returned 0x119 [0103.679] ReadFile (in: hFile=0x340, lpBuffer=0x2363a70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f090, lpOverlapped=0x0 | out: lpBuffer=0x2363a70*, lpNumberOfBytesRead=0x19f090*=0x119, lpOverlapped=0x0) returned 1 [0103.679] ReadFile (in: hFile=0x340, lpBuffer=0x2363a70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ef54, lpOverlapped=0x0 | out: lpBuffer=0x2363a70*, lpNumberOfBytesRead=0x19ef54*=0x0, lpOverlapped=0x0) returned 1 [0103.679] CloseHandle (hObject=0x340) returned 1 [0103.680] GetCurrentProcess () returned 0xffffffff [0103.680] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19f208 | out: TokenHandle=0x19f208*=0x340) returned 1 [0103.680] GetCurrentProcess () returned 0xffffffff [0103.680] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19f208 | out: TokenHandle=0x19f208*=0x344) returned 1 [0103.699] GetCurrentProcess () returned 0xffffffff [0103.699] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19efcc | out: TokenHandle=0x19efcc*=0x348) returned 1 [0103.731] GetCurrentProcess () returned 0xffffffff [0103.731] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19efe0 | out: TokenHandle=0x19efe0*=0x34c) returned 1 [0104.275] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x19f258 | out: lpWSAData=0x19f258) returned 0 [0104.284] WSASocketW (af=2, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x0) returned 0x374 [0104.696] setsockopt (s=0x374, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0104.696] closesocket (s=0x374) returned 0 [0104.696] WSASocketW (af=23, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x0) returned 0x374 [0104.697] setsockopt (s=0x374, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0104.698] closesocket (s=0x374) returned 0 [0104.702] GetCurrentProcess () returned 0xffffffff [0104.702] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19f00c | out: TokenHandle=0x19f00c*=0x374) returned 1 [0104.706] GetCurrentProcess () returned 0xffffffff [0104.706] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19f020 | out: TokenHandle=0x19f020*=0x378) returned 1 [0104.734] WSASocketW (af=2, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x37c [0104.742] setsockopt (s=0x37c, level=65535, optname=4098, optval="", optlen=4) returned 0 [0104.742] setsockopt (s=0x37c, level=65535, optname=4097, optval="", optlen=4) returned 0 [0104.766] WSAConnect (s=0x37c, name=0x236c354*(sa_family=2, sin_port=0x7b5, sin_addr="185.157.160.136"), namelen=16, lpCallerData=0x0, lpCalleeData=0x0, lpSQOS=0x0, lpGQOS=0x0) Thread: id = 4 os_tid = 0x788 Thread: id = 5 os_tid = 0x7b0 Thread: id = 6 os_tid = 0x14c [0093.945] CoGetContextToken (in: pToken=0x433fc3c | out: pToken=0x433fc3c) returned 0x0 [0093.945] CObjectContext::QueryInterface () returned 0x0 [0093.945] CObjectContext::GetCurrentThreadType () returned 0x0 [0093.945] Release () returned 0x0 [0093.945] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0093.945] RoInitialize () returned 0x1 [0093.945] RoUninitialize () returned 0x0